Encryption CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A tester is evaluating a system that uses RSA with PKCS#1 v1.5 padding for encryption. The tester sends malformed ciphertext to the server and observes that the server responds with different error messages for 'invalid padding' and 'decryption failed'. Which attack is the tester likely to perform?

   • AA chosen-ciphertext attack using the server's public key.
   • BA timing attack to recover the private key.
   • CA factorization attack on the RSA modulus.
   • DA Bleichenbacher attack (padding oracle) to recover the plaintext.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the context of encryption, what is decryption?

   • AThe process of hashing data to produce a fixed-length digest
   • BThe process of generating a new encryption key
   • CThe process of compressing data to reduce its size
   • DThe process of converting ciphertext back into plaintext using the appropriate key
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What does testing for proper implementation of encryption typically involve?

   • AEnsuring that encryption keys are hardcoded in the application source code
   • BConfirming that only one encryption algorithm is used for all purposes
   • CChecking that the encryption is applied consistently across all data flows and storage locations
   • DVerifying that the encryption algorithm is kept secret from the public
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security tester is reviewing a system that uses a KMS to manage encryption keys. The KMS supports automatic key rotation. The tester needs to ensure that data encrypted with an old key can still be decrypted after rotation. Which feature should the tester verify is enabled?

   • AKey export, so that old keys can be stored externally.
   • BKey re-encryption, so that all data is re-encrypted with the new key.
   • CKey versioning, so that old keys are retained for decryption.
   • DKey deletion, so that old keys are removed after rotation.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security tester is reviewing a system that uses a single shared symmetric key to encrypt all data in a microservices architecture. The key is stored in a configuration file and has not been rotated in 3 years. The tester must recommend a solution that improves security without requiring a complete rewrite of the services. Which recommendation is the most effective?

   • AUse a hardware security module (HSM) to store the single shared key and restrict access.
   • BImplement a key management service (KMS) with per-service keys and automated rotation.
   • CSwitch to asymmetric encryption for all service-to-service communication.
   • DRotate the existing key manually every 6 months and store it in a different config file.
   Reveal Solution Discussion Select an answer first