Symmetric Encryption and Defensive Coding CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A developer is implementing AES encryption for a database column that stores short strings like status codes. The application must be able to search for exact matches of encrypted values. Which mode of operation is most appropriate?

   • AECB mode, because it is deterministic and allows equality searches on ciphertext
   • BCBC mode with a random IV
   • CGCM mode with a random nonce
   • DUse a deterministic mode like AES-SIV (RFC 5297)
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A .NET application uses AES-256 to encrypt data at rest. The key is stored in a local file with permissions set to allow only the application service account to read it. The security team requires that the key be rotated without downtime and without re-encrypting all existing data. Which strategy should be used?

   • AUse a key hierarchy: a master key encrypts data-encryption keys (DEKs); rotate the master key and re-wrap DEKs without re-encrypting data
   • BUse a key-wrapping scheme: encrypt the new key with the old key and store both, then transition to the new key for new data
   • CUse the same key but change the IV for each encryption, and consider that as rotation
   • DGenerate a new key, re-encrypt all existing data with the new key, and then delete the old key
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A .NET application uses a symmetric key to encrypt data in a multi-tenant environment. Each tenant has its own database, but they share the same application pool. The security team requires that a compromise of one tenant's key does not expose other tenants' data. What is the best key management strategy?

   • AGenerate a unique data-encryption key (DEK) per tenant, and encrypt each DEK with a master key stored in an HSM
   • BUse the same key for all tenants but rotate it monthly
   • CUse a single master key for all tenants, but store it in a hardware security module (HSM)
   • DUse a different key for each tenant and store them in a plain-text database table
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security review of a .NET application finds that it uses the `RijndaelManaged` class with a 128-bit key and CBC mode. The application is running on .NET Framework 4.8. What is the most appropriate action?

   • AKeep `RijndaelManaged` but increase the key size to 256 bits.
   • BSwitch to `TripleDES` for better security.
   • CUse `RijndaelManaged` with a 256-bit block size.
   • DReplace `RijndaelManaged` with the `Aes` class, which is the standardized version of Rijndael with a fixed block size of 128 bits.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer is implementing AES encryption for a network protocol that transmits small, fixed-size messages. The protocol already includes a message authentication code (MAC) for integrity. Which mode of operation is most appropriate to provide confidentiality without duplicating integrity protection?

   • AECB mode, because the messages are small and fixed-size
   • BCFB mode with a static IV
   • CCBC mode with a random IV per message
   • DGCM mode, which provides both encryption and authentication
   Reveal Solution Discussion Select an answer first