Cryptographic Attacks CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A .NET application stores hashed passwords using the `Rfc2898DeriveBytes` class with 10,000 iterations. A security audit recommends increasing the iteration count. What is the primary reason for this recommendation?

   • ATo prevent rainbow table attacks by making each hash unique
   • BTo slow down brute-force and dictionary attacks by increasing the computational cost per guess
   • CTo reduce the chance of hash collisions
   • DTo make the hash output longer and more secure
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A .NET application must protect passwords in a database. Which countermeasure is most effective against rainbow table attacks?

   • AStore passwords in plaintext for simplicity
   • BEncrypt passwords with AES using a hardcoded key
   • CUse a cryptographic hash function with a unique salt per user
   • DUse MD5 without salt
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An attacker sends modified ciphertext to a .NET application and observes whether the application returns a padding error. By analyzing these responses, the attacker is able to recover the plaintext. Which type of cryptographic attack is this?

   • ARainbow table attack
   • BBrute force attack
   • CDictionary attack
   • DPadding oracle attack
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A .NET developer is implementing encryption for a chat application. The requirement is to ensure that messages cannot be tampered with during transmission. Which cryptographic approach should be used?

   • AUse AES-GCM, which provides both confidentiality and integrity
   • BUse a simple checksum like CRC32 to detect changes
   • CUse RSA encryption with a 1024-bit key
   • DUse AES-CBC encryption without any authentication
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A .NET application processes credit card numbers and stores them encrypted in a database. The application uses AES-CBC with a fixed key and a fixed IV. The development team is required to protect the data from both database theft and insider access. They are considering the following options: (1) switch to AES-GCM with a unique nonce per record, (2) use a hardware security module (HSM) to store the key, (3) implement application-level encryption with per-user keys, (4) rely on transparent data encryption (TDE) at the database level. Which combination of measures would provide the strongest defense against both threats?

   • AUse TDE alone to encrypt the entire database.
   • BUse AES-CBC with a random IV per record and store the key in the database.
   • CUse per-user keys and store them in the application configuration file.
   • DUse AES-GCM with a unique nonce per record and store the key in an HSM.
   Reveal Solution Discussion Select an answer first