Symmetric Encryption and Defensive Coding CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A .NET developer is writing code to generate an AES key for encrypting user data. Which code snippet correctly generates a cryptographically strong random key?

   • Avar key = Guid.NewGuid().ToByteArray();
   • Bvar key = new byte[32]; new Random().NextBytes(key);
   • Cvar key = Encoding.UTF8.GetBytes("my-secret-key");
   • Dusing (var aes = Aes.Create()) { aes.GenerateKey(); var key = aes.Key; }
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A .NET developer is writing code to encrypt a file. The developer uses the following approach: `using (var aes = Aes.Create()) { aes.Key = Encoding.UTF8.GetBytes("MySecretKey123"); aes.IV = new byte[16]; ... }`. What is the primary security flaw in this code?

   • AThe key is too long for AES.
   • BThe IV should be the same as the key to ensure compatibility.
   • CThe key is derived from a short, predictable string and the IV is all zeros.
   • DThe code should use a different algorithm, such as RSA, for file encryption.
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A team is designing a system that encrypts small messages (less than 1 KB) and needs to minimize ciphertext overhead. They are considering AES-GCM and AES-CBC with HMAC. The system must also support parallel decryption of multiple messages. Which approach is the best trade-off?

   • AUse AES-ECB with no padding, which has zero overhead but is insecure.
   • BUse AES-GCM with a 12-byte nonce and a 16-byte tag, which adds only 28 bytes of overhead and supports parallel decryption.
   • CUse AES-CTR with a fixed nonce and no authentication, which has minimal overhead.
   • DUse AES-CBC with PKCS7 padding and a separate HMAC, which adds more overhead but is more widely supported.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security audit of a .NET application reveals that it uses the TripleDES algorithm with a 128-bit effective key length. The audit recommends migrating to a more modern algorithm. Which replacement should the developer choose?

   • AAES-256
   • BRC4 with a 128-bit key
   • CDES with a 56-bit key
   • DBlowfish with a 64-bit block size
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of key rotation in symmetric encryption?

   • ATo make encryption faster.
   • BTo reduce the impact of a key compromise and limit data exposure.
   • CTo allow multiple users to use the same key.
   • DTo ensure the key is never reused.
   Reveal Solution Discussion Select an answer first