A .NET application encrypts data with AES-256-CBC. The key is stored in an environment variable. The security team requires that the key be rotated every 30 days. The application must continue to decrypt data encrypted with previous keys. Which approach should be used?

Use a key-wrapping scheme: encrypt the new key with the old key and store the wrapped key in the environment variable

Use a key hierarchy: store a master key in the environment variable and use it to wrap data-encryption keys (DEKs) that are stored with the data

Store only the current key in the environment variable and re-encrypt all data with the new key on each rotation

Store a list of all previous keys in the environment variable and try each one during decryption

A .NET application encrypts data with AES-256 and stores the key in a local file. The security team requires that the key be protected from unauthorized access even if an attacker gains read access to the file system. Which additional control should be implemented?

Encrypt the key file using DPAPI with the CurrentUser scope

Use a hardcoded key in the application code instead of a file

Store the key in the Windows Registry under HKEY_LOCAL_MACHINE

Set the file permissions to read-only for the service account

What is a common pitfall to avoid when handling IVs in symmetric encryption?

Reusing the same IV for multiple encryptions with the same key.

Transmitting the IV along with the ciphertext.

Using a random IV generated by a secure random number generator.

Using a unique IV for each encryption.

A developer is implementing AES-GCM for a high-throughput service that encrypts many messages per second. The current implementation uses a 96-bit nonce generated randomly for each message. The service occasionally throws an exception indicating that the nonce has been reused. What is the most likely cause and the best fix?

The nonce is too short; increase the nonce size to 128 bits

The random nonce generation is colliding due to the birthday paradox; use a counter-based nonce that is guaranteed unique per key

The key is being rotated too frequently; use a fixed key for the lifetime of the service

The random number generator is not cryptographically secure; switch to a hardware random number generator

EC-CouncilCertified Application Security Engineer (.NET)

Domain 5Objective 1

Symmetric Encryption and Defensive Coding CASENET Practice Questions (Page 4)

Part of the Secure Coding: Cryptography domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

5concepts

Questions 16–20

16expert · hard
A .NET application encrypts data with AES-256-CBC. The key is stored in an environment variable. The security team requires that the key be rotated every 30 days. The application must continue to decrypt data encrypted with previous keys. Which approach should be used?
Select an answer first
17foundation · easy
Which block cipher mode of operation is considered insecure because identical plaintext blocks produce identical ciphertext blocks?
Select an answer first
18application · medium
A .NET application encrypts data with AES-256 and stores the key in a local file. The security team requires that the key be protected from unauthorized access even if an attacker gains read access to the file system. Which additional control should be implemented?
Select an answer first
19foundation · easy
What is a common pitfall to avoid when handling IVs in symmetric encryption?
Select an answer first
20expert · hard
A developer is implementing AES-GCM for a high-throughput service that encrypts many messages per second. The current implementation uses a 96-bit nonce generated randomly for each message. The service occasionally throws an exception indicating that the nonce has been reused. What is the most likely cause and the best fix?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Symmetric Encryption and Defensive Coding CASENET Practice Questions (Page 4)

Questions 16–20

A .NET application encrypts data with AES-256-CBC. The key is stored in an environment variable. The security team requires that the key be rotated every 30 days. The application must continue to decrypt data encrypted with previous keys. Which approach should be used?

Which block cipher mode of operation is considered insecure because identical plaintext blocks produce identical ciphertext blocks?

A .NET application encrypts data with AES-256 and stores the key in a local file. The security team requires that the key be protected from unauthorized access even if an attacker gains read access to the file system. Which additional control should be implemented?

What is a common pitfall to avoid when handling IVs in symmetric encryption?

Keep studying — Secure Coding: Cryptography