Encryption CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement best describes a key characteristic of symmetric encryption?

   • AIt does not require key management.
   • BIt is slower than asymmetric encryption for the same security level.
   • CIt uses the same key for both encryption and decryption.
   • DIt uses two different keys: one for encryption and one for decryption.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security tester is reviewing a system that uses Blowfish for encrypting sensitive data. The tester is concerned about the algorithm's strength. What is the most appropriate recommendation?

   • AReplace Blowfish with Twofish, which has a 128-bit block size and is more secure.
   • BReplace Blowfish with AES-256, which is the current standard for symmetric encryption.
   • CIncrease the key length of Blowfish to 256 bits to improve security.
   • DKeep using Blowfish because it is a well-known algorithm with a 64-bit block size.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security tester needs to protect sensitive data so that it cannot be read by unauthorized parties. Which term best describes the process of transforming plaintext into ciphertext using a key?

   • AEncryption
   • BObfuscation
   • CHashing
   • DEncoding
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a common encryption vulnerability related to improper padding?

   • ACross-site scripting
   • BPadding oracle attack
   • CSQL injection
   • DMan-in-the-middle attack
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security tester is assessing a mobile application that communicates with a backend server. The tester finds that the application uses TLS, but it does not validate the server's certificate properly. What is the most likely impact of this vulnerability?

   • AAn attacker could perform a man-in-the-middle attack and intercept or modify the data in transit.
   • BThe application could crash due to an invalid certificate.
   • CThe server could be forced to use a weaker encryption algorithm.
   • DThe data at rest on the mobile device could be decrypted by an attacker.
   Reveal Solution Discussion Select an answer first