Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security engineer is reviewing a web application that stores user passwords. The current implementation uses unsalted MD5 hashes. The engineer wants to improve security without breaking the login process. Which change is most appropriate?

   • AMigrate to a salted, slow hash function like bcrypt and rehash passwords on next login.
   • BUse SHA-256 with a random salt for each user.
   • CAdd a static salt to the MD5 hash and continue using MD5.
   • DEncrypt the MD5 hashes with AES-256 to make them unreadable.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security engineer is reviewing a web application that uses AES in CBC mode for encrypting session tokens. The application returns different error messages for valid and invalid padding. Which attack is possible, and what is the best mitigation?

   • APadding oracle attack; use AES-GCM instead of CBC mode.
   • BWeak key generation attack; use a longer random key.
   • CReplay attack; add a timestamp to the token.
   • DDowngrade attack; disable older TLS versions.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key management best practice regarding cryptographic keys?

   • AUse the same key for all encryption operations to simplify management
   • BStore keys in the same database as the encrypted data for convenience
   • CRotate keys periodically and revoke them when compromised
   • DEmbed keys in application source code for easy access
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst notices that the application's TLS configuration allows CBC-mode cipher suites. The analyst is concerned about a padding oracle attack. Which mitigation should be applied?

   • AKeep CBC-mode cipher suites but add a short timeout to the TLS handshake.
   • BDisable CBC-mode cipher suites and enable only AEAD ciphers such as AES-GCM.
   • CUse TLS 1.0 with CBC ciphers to maintain compatibility with older clients.
   • DIncrease the key length from 128-bit to 256-bit for CBC ciphers.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is hashing commonly used for storing passwords instead of encryption?

   • AHashing is faster than encryption
   • BHashing is a one-way function, so the original password cannot be recovered from the stored hash
   • CHashing is reversible, allowing password recovery
   • DHashing provides confidentiality for the password
   Reveal Solution Discussion Select an answer first