Symmetric Encryption and Defensive Coding CASENET Practice Questions (Page 8)

Questions 36–38

1. 36expert · medium

   A developer is encrypting a large file (several GB) using AES-GCM in .NET. The current implementation loads the entire file into memory and encrypts it in one call. The application is running on a server with limited memory. What is the best approach?

   • AUse AES-GCM with a large buffer to process the file in memory.
   • BUse AES-ECB with streaming to avoid memory issues.
   • CUse AES-CTR with a counter and no authentication to stream the file.
   • DStream the file in chunks using a CryptoStream with AES-GCM, but note that .NET's GCM implementation does not support streaming; use AES-CBC with HMAC instead.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   A company needs to encrypt data in a multi-tenant SaaS application. Each tenant's data must be encrypted with a unique key, and the keys must be managed separately. The application is built on .NET and uses Azure. Which approach provides the best isolation and manageability?

   • AStore each tenant's key in a database table with a foreign key to the tenant record.
   • BUse a single master key in Azure Key Vault and derive a unique data key for each tenant using a KDF with a tenant-specific salt.
   • CGenerate a random key for each tenant and store it in the tenant's configuration file.
   • DUse the same key for all tenants but with different IVs.
   Reveal Solution Discussion Select an answer first
3. 38application · medium

   An organization is required to rotate encryption keys every 90 days. The current .NET application uses a single symmetric key stored in a configuration file to encrypt data at rest. The team wants to minimize downtime and avoid re-encrypting all existing data during rotation. What is the most appropriate approach?

   • AUse a key-wrapping scheme: encrypt data with a data encryption key (DEK) and wrap the DEK with a key encryption key (KEK); rotate the KEK and re-wrap the DEK.
   • BKeep the same key but change the IV for each record during rotation.
   • CStore multiple keys in the config file and use the newest one for encryption, keeping old keys for decryption.
   • DGenerate a new key and re-encrypt all data during a scheduled maintenance window.
   Reveal Solution Discussion Select an answer first