Symmetric Encryption and Defensive Coding CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A .NET application encrypts data using a key that is generated at runtime and stored in memory. The application runs on a shared hosting environment. What is the primary risk of this approach?

   • AThe key will be lost when the application restarts, making previously encrypted data unrecoverable.
   • BThe key is vulnerable to memory dumps by other tenants on the shared host.
   • CThe key is not stored in a secure key vault, so it is not compliant with security standards.
   • DThe key is not strong enough because it is generated at runtime.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A .NET application encrypts sensitive data using AES-256. The current implementation stores the encryption key in the source code as a string constant. The security team mandates that keys be rotated every 90 days and that no key material appear in source control. Which approach should the developer adopt?

   • AGenerate a new key at application startup and keep it in memory for the lifetime of the process
   • BEmbed the key in the assembly metadata using a custom attribute
   • CUse a hardware security module (HSM) or a managed key vault to store the key, and reference it by identifier from the application
   • DStore the key in a plain-text configuration file outside the source tree and read it at runtime
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security audit of a .NET application reveals that it uses DES with a 56-bit key and ECB mode to encrypt user session tokens. The application is being modernized. Which replacement is the most secure and appropriate?

   • A3DES in CBC mode
   • BAES-128 in ECB mode
   • CAES-256 in GCM mode
   • DDES in CBC mode with a random IV
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A developer is implementing symmetric encryption for a legacy system that must interoperate with a third-party service. The service only supports DES. The security team has prohibited the use of DES in new code. What should the developer do?

   • AUse 3DES with a 168-bit key, which is a stronger variant of DES and still interoperable with the third party
   • BUse AES-256 and negotiate a protocol upgrade with the third party to support AES
   • CUse DES with a 56-bit key and a random IV, since the third party requires it
   • DUse DES with a 128-bit key by padding the key material
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a best practice for using an Initialization Vector (IV) in CBC mode?

   • AUse a predictable IV derived from the plaintext.
   • BUse a new random IV for each encryption operation.
   • CUse the encryption key as the IV.
   • DUse a fixed IV that is shared with all users.
   Reveal Solution Discussion Select an answer first