Encryption CT-SEC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following best describes a key difference between symmetric and asymmetric encryption?

   • ASymmetric encryption requires a public key infrastructure (PKI)
   • BSymmetric encryption uses the same key for encryption and decryption, while asymmetric encryption uses a pair of keys
   • CSymmetric encryption is always stronger than asymmetric encryption
   • DAsymmetric encryption is faster than symmetric encryption for large data
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a characteristic of the AES algorithm?

   • AIt is a symmetric block cipher that supports key sizes of 128, 192, and 256 bits
   • BIt is a hash function that produces a 256-bit digest
   • CIt is a stream cipher that encrypts data bit by bit
   • DIt is an asymmetric algorithm used for digital signatures
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a side-channel attack in the context of encryption?

   • AAn attack that tries all possible keys until the correct one is found
   • BAn attack that intercepts encrypted data and tries to decrypt it without the key
   • CAn attack that exploits information leaked during the encryption process, such as timing or power consumption
   • DAn attack that uses social engineering to trick users into revealing their keys
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A tester is assessing a custom encryption library used by an application. The library implements AES-CBC with PKCS#7 padding. The tester sends a modified ciphertext to the application and observes that the application returns different error messages for 'invalid padding' versus 'invalid MAC'. Which vulnerability is the tester likely exploiting?

   • AA padding oracle attack, because the application reveals whether padding is valid.
   • BA birthday attack, because the IV is reused across messages.
   • CA side-channel attack, because the timing of the error responses leaks information.
   • DA key-reuse attack, because the same key is used for multiple messages.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A healthcare organization must protect patient records stored in a database. The compliance requirement states that data must be encrypted at rest. The organization also needs to be able to search for specific patient records without decrypting the entire database. Which approach should the tester recommend?

   • AEncrypt the database with a weak algorithm like DES to improve performance.
   • BEncrypt the entire database with AES-256 and decrypt all records when searching.
   • CDo not encrypt the database, but rely on network encryption to protect the data.
   • DUse column-level encryption for sensitive fields and store searchable hashes for indexed columns.
   Reveal Solution Discussion Select an answer first