A startup is building a lightweight IoT device with limited CPU and memory. The device needs to establish a secure channel with a server using asymmetric encryption. Which algorithm should the developer choose to minimize computational overhead?

Diffie-Hellman with a 2048-bit key

Elliptic Curve Cryptography (ECC) with a 256-bit key

A developer is choosing between RSA and ECC for a new .NET application that will run on both high-performance servers and low-power mobile devices. The application requires both encryption and digital signatures. What is the most balanced choice?

Use RSA for both encryption and signatures.

Use RSA for encryption and ECDSA for signatures.

Use ECC for both encryption and signatures.

Use ECC for encryption and RSA for signatures.

A .NET developer is writing code to generate RSA key pairs for a new service. Which implementation is secure?

Using `Random` to generate a key and passing it to RSA.

Using `new RSACryptoServiceProvider(1024)` to generate a key pair.

Hardcoding a pre-generated key pair in the source code.

Using `RSA.Create(2048)` and letting the .NET runtime generate the key.

A .NET developer is implementing RSA encryption in a web application. The developer wants to prevent padding oracle attacks. Which RSA padding scheme should be used?

OAEP padding (Optimal Asymmetric Encryption Padding)

A .NET developer is integrating a third-party library that performs RSA decryption. The library is not well-maintained and has known vulnerabilities. The developer cannot replace the library immediately. Which action is most appropriate to mitigate the risk?

Increase the RSA key size to 8192 bits to make attacks harder.

Wrap the library in a secure API that validates inputs and uses constant-time comparisons.

Disable all error messages from the library to hide vulnerabilities.

Use the library only in a non-production environment.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 5Objective 2

Asymmetric Encryption and Defensive Coding CASENET Practice Questions (Page 5)

Part of the Secure Coding: Cryptography domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

Questions 21–25

21application · medium
A startup is building a lightweight IoT device with limited CPU and memory. The device needs to establish a secure channel with a server using asymmetric encryption. Which algorithm should the developer choose to minimize computational overhead?
Select an answer first
22expert · hard
A developer is choosing between RSA and ECC for a new .NET application that will run on both high-performance servers and low-power mobile devices. The application requires both encryption and digital signatures. What is the most balanced choice?
Select an answer first
23application · medium
A .NET developer is writing code to generate RSA key pairs for a new service. Which implementation is secure?
Select an answer first
24application · medium
A .NET developer is implementing RSA encryption in a web application. The developer wants to prevent padding oracle attacks. Which RSA padding scheme should be used?
Select an answer first
25expert · hard
A .NET developer is integrating a third-party library that performs RSA decryption. The library is not well-maintained and has known vulnerabilities. The developer cannot replace the library immediately. Which action is most appropriate to mitigate the risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.