Encryption CCISO Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst notices that an attacker is intercepting and relaying communications between a user and a legitimate website. The user believes they are communicating directly with the website, but the attacker is capturing and modifying the traffic. Which type of attack is this, and what is the primary mitigation?

   • ABrute-force attack; use longer encryption keys.
   • BSide-channel attack; use constant-time algorithms.
   • CMan-in-the-middle attack; use TLS with certificate validation.
   • DReplay attack; use nonces and timestamps.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A multinational corporation needs to transfer sensitive legal documents between its headquarters and a branch office. The documents are stored in a cloud file share. The CISO must ensure confidentiality and integrity during transfer. The company already uses a cloud provider that offers TLS for data in transit. What additional measure is most appropriate to provide end-to-end protection beyond TLS?

   • AEncrypt the files with a pre-shared key using AES-256 before uploading them to the cloud share.
   • BEnable multi-factor authentication on the cloud file share.
   • CRely on the cloud provider's TLS to protect the files during transfer.
   • DUse a VPN to connect to the cloud provider's network.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security analyst is investigating a possible brute-force attack on an encrypted file. The analyst knows the file was encrypted with AES-256 and that the password is a 6-character lowercase alphabetic password. Which mitigation would be most effective in preventing this type of attack?

   • AUse a different encryption mode, such as ECB instead of CBC.
   • BUse a longer encryption key, such as AES-512.
   • CUse a hash of the password as the encryption key.
   • DUse a key derivation function (KDF) with a high iteration count and a random salt.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is required to encrypt all sensitive data stored in its database. The database is hosted on a virtual machine in the company's private cloud. The CISO wants to ensure that the encryption keys are not stored on the same server as the data. Which solution should the CISO implement?

   • AUse a hash of the database password as the encryption key.
   • BUse transparent data encryption (TDE) with keys stored in a separate key management server.
   • CEncrypt the database files with a password stored in the application configuration.
   • DUse full-disk encryption on the VM's virtual disk.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An organization is deploying a new internal application that requires mutual TLS (mTLS) between clients and the server. The organization has an internal CA. The CISO wants to ensure that only company-issued devices can connect. Which configuration should the CISO implement?

   • AUse a public CA to issue client certificates to all employees.
   • BIssue client certificates from the internal CA and configure the server to require and validate client certificates.
   • CUse a shared password for all clients and configure the server to accept it.
   • DConfigure the server to use a self-signed certificate and distribute it to all clients.
   Reveal Solution Discussion Select an answer first