Hashing, Digital Signatures, and Digital Certificates CASENET Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A .NET developer is updating a legacy authentication system that stores user passwords using SHA-256 with a static salt. The company's security policy now requires each password to be hashed with a unique, randomly generated salt and a computationally expensive algorithm. The application runs on .NET 8 and must use only built-in framework APIs. Which approach should the developer implement?

   • AUse Rfc2898DeriveBytes.Pbkdf2 with a 128-bit random salt and 600,000 iterations, storing the salt and iteration count with the hash.
   • BEncrypt each password with AES-256 using a key derived from the user's salt, then store the ciphertext.
   • CHash the password with SHA-512 and append the user ID to the salt to ensure uniqueness across the database.
   • DContinue using SHA-256 but generate a new random salt for each user and concatenate it with the password before hashing.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company wants to issue certificates to its employees for internal applications. The company wants to control the issuance and revocation of certificates without relying on an external provider. What should the company deploy?

   • AA certificate template stored on a shared drive.
   • BA private CA using Active Directory Certificate Services.
   • CA public CA like Let's Encrypt.
   • DSelf-signed certificates for each employee.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a typical step in the lifecycle of a digital certificate?

   • ACertificate renewal
   • BHash collision
   • CSymmetric encryption
   • DKey exchange
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A system administrator notices that a web server's TLS certificate is about to expire in 10 days. The certificate was issued by an internal CA. The administrator needs to replace it without causing downtime. Which action should the administrator take?

   • AExtend the validity period of the existing certificate by editing its properties in the CA database.
   • BWait until the certificate expires and then restart the web server to load the new certificate.
   • CReuse the existing private key and re-issue the same certificate with a new expiration date.
   • DGenerate a new key pair, create a CSR, submit it to the CA, and install the new certificate before the old one expires.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A .NET application validates a client certificate during TLS mutual authentication. The certificate is issued by an intermediate CA that is not in the application's trust store. What should the application do?

   • AAccept the certificate if the subject name matches the expected client.
   • BAccept the certificate if it is not expired.
   • CReject the certificate because the chain cannot be built to a trusted root.
   • DAdd the intermediate CA to the trusted root store.
   Reveal Solution Discussion Select an answer first