Cryptography GSEC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A software vendor distributes updates to customers. The vendor wants to ensure that customers can verify the authenticity of the updates even if the download server is compromised. Which approach is the most robust?

   • APublish a hash of the update on the vendor's website.
   • BUse a long checksum like SHA-512 and publish it in the release notes.
   • CEncrypt the update with a symmetric key and provide the key to customers.
   • DSign the update with the vendor's private key and publish the public key in a widely trusted certificate.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is investigating a breach where an attacker was able to read encrypted traffic by measuring the time it took for the server to respond. Which type of attack occurred, and what is the best mitigation?

   • ASide-channel attack; implement constant-time algorithms and use hardware with constant-time operations
   • BHash collision attack; use a random salt
   • CMan-in-the-middle attack; use longer keys
   • DBrute-force attack; use a stronger hash function
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A legal department requires proof that a specific executive approved a contract. The approval must be verifiable by anyone in the company, and the executive must not be able to deny signing it. What should be implemented?

   • AThe executive emails the document with a scanned signature image
   • BThe executive signs the document hash with their private key
   • CThe executive sends the document over TLS to the legal team
   • DThe executive encrypts the document with their public key
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization encrypts sensitive files with AES-256. The security team wants to ensure that if a key is compromised, the damage is limited. Which practice is most effective?

   • AUse a different key for each file or dataset and rotate them periodically
   • BStore the key in the same database as the encrypted files
   • CUse the same key for all files to simplify management
   • DUse a shorter key to make encryption faster
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is investigating a suspected data breach. They find that an attacker obtained a large number of password hashes from a database. The hashes were created with SHA-256 and no salt. The team wants to determine which passwords are weak. Which attack would be most effective?

   • AA brute-force attack trying every possible password combination.
   • BA side-channel attack on the server's memory.
   • CA rainbow table attack using precomputed hashes of common passwords.
   • DA collision attack to find two passwords with the same hash.
   Reveal Solution Discussion Select an answer first