Asymmetric Encryption and Defensive Coding CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A .NET developer is implementing ECDSA for signing JWT tokens. Which practice is essential to prevent private key exposure?

   • AStore the private key in the JWT payload.
   • BUse a deterministic nonce derived from the message hash.
   • CUse a new random nonce for each signature.
   • DUse the same nonce for all signatures to improve performance.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A .NET developer is implementing RSA encryption and must decide between RSA-OAEP and RSA-PSS for a new feature that encrypts session keys. The security team requires resistance to chosen-ciphertext attacks. What should the developer choose?

   • ARSA-OAEP for both encryption and signatures.
   • BRSA-OAEP for encryption and RSA-PSS for signatures.
   • CRSA-PSS for encryption and RSA-OAEP for signatures.
   • DRSA-PSS for both encryption and signatures.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A .NET application uses a hardcoded RSA private key embedded in the source code to sign JWTs. The security team has flagged this as a critical vulnerability. What is the best remediation?

   • AEmbed the private key in the database and retrieve it on application startup.
   • BUse Azure Key Vault to store the private key and retrieve it at runtime.
   • CObfuscate the private key in the source code to hide it from casual inspection.
   • DMove the private key to a configuration file and encrypt it with a hardcoded password.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company uses RSA key pairs for signing and encryption. The security policy requires that keys be rotated every 90 days. What is the best practice for key rotation?

   • AGenerate a new key pair and update the public key in all systems.
   • BUse the same key pair but re-issue the certificate.
   • CDelete the old key pair and use a symmetric key instead.
   • DKeep the same key pair but change the passphrase.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A .NET application verifies digital signatures on software updates. The developer wants to ensure that the verification process is secure. Which practice is most important?

   • AUse a large RSA key size, such as 4096 bits.
   • BUse a fast hashing algorithm like MD5.
   • CUse a trusted public key that is distributed out-of-band.
   • DVerify the signature only if the update is downloaded from a secure connection.
   Reveal Solution Discussion Select an answer first