Hashing, Digital Signatures, and Digital Certificates CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A .NET developer is updating a legacy application that stores user passwords using SHA-1 with no salt. The security team requires that passwords be stored using a modern, salted, slow hashing algorithm. Which approach should the developer implement?

   • AUse SHA-256 with a per-user random salt and store the salt alongside the hash.
   • BUse PBKDF2 with a per-user random salt and a high iteration count.
   • CUse HMAC-SHA256 with a static application-wide key and no salt.
   • DUse SHA-1 with a per-user salt and store the salt in a separate database.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A .NET developer is migrating a legacy password store from SHA-1 with no salt to a modern scheme. The application has 500,000 existing users, and the security team requires that existing passwords remain verifiable after migration. The team also wants to minimize the risk of brute-force attacks on the new hashes. Which migration strategy best meets these requirements?

   • AOn next login, verify the old SHA-1 hash, then rehash the password with PBKDF2 and a new random salt, and delete the old hash.
   • BRequire all users to reset their passwords immediately, then store only PBKDF2 hashes.
   • CImmediately rehash all existing SHA-1 hashes with PBKDF2 using a global salt.
   • DStore both the old SHA-1 hash and a new PBKDF2 hash for each user, and verify against either.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a recommended algorithm for securely hashing passwords?

   • ASHA-1
   • BAES
   • CPBKDF2
   • DMD5
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is a unique salt added to each password before hashing?

   • ATo ensure that identical passwords produce different hash values.
   • BTo make the hash longer and more difficult to store.
   • CTo speed up the hashing process.
   • DTo encrypt the password before hashing.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's .NET application validates client certificates for a partner API. The application currently checks the certificate's expiration date and trust chain but does not check revocation status. A partner's certificate was compromised, and the CA revoked it. The application still accepts the certificate. Which change should the developer make to ensure revoked certificates are rejected?

   • AShorten the certificate's validity period to reduce the window of exposure.
   • BRequire the partner to re-issue the certificate with a new key pair.
   • CAdd the revoked certificate to the application's trust store.
   • DEnable CRL or OCSP checking in the certificate validation logic.
   Reveal Solution Discussion Select an answer first