Practical Cryptography GXPN Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A penetration tester is writing a script to verify a digital signature on a firmware update. The script has access to the signer's public key but not the private key. Which operation should the script perform?

   • AHash the signature and compare it to the firmware hash.
   • BUse the public key to derive the private key and verify the signature.
   • CEncrypt the firmware with the public key and compare it to the signature.
   • DDecrypt the signature with the public key and compare it to the hash of the firmware.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is assessing a legacy application that uses a fixed pre-shared key for all client-server encryption. The tester wants to demonstrate a more secure key exchange that also provides forward secrecy. Which approach should the tester recommend?

   • AReplace the fixed key with a static RSA key pair and encrypt the session key with the public key.
   • BUse a longer fixed pre-shared key (e.g., 256-bit) to increase brute-force resistance.
   • CImplement ephemeral Diffie-Hellman (DHE) key exchange to derive a unique session key per connection.
   • DSwitch to AES-ECB mode with the existing fixed key to simplify the protocol.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is investigating a breach where an attacker was able to forge authentication tokens. The tokens are created by concatenating a user ID and a timestamp, then hashing with SHA-256. The hash is not keyed. Which weakness allowed the forgery?

   • AThe user ID is not encrypted.
   • BSHA-256 is vulnerable to length-extension attacks.
   • CThe hash is not keyed, so an attacker can compute valid hashes for arbitrary inputs.
   • DThe timestamp is too long, causing collisions.
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A developer is writing a script to verify the integrity of downloaded firmware. The script currently uses MD5. A security review flags this as insufficient. Which change should the developer make?

   • AUse base64 encoding of the MD5 hash to make it longer.
   • BUse CRC32 instead of MD5 for faster checks.
   • CUse MD5 but add a salt to the hash.
   • DSwitch to SHA-256 and compare against a known-good hash provided by the vendor.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes symmetric encryption?

   • AIt uses a public key to encrypt and a private key to decrypt.
   • BIt uses the same key for both encryption and decryption.
   • CIt uses a different key for each block of data.
   • DIt relies on a third-party certificate authority to distribute keys.
   Reveal Solution Discussion Select an answer first