Encryption CT-STE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why does hybrid encryption typically use asymmetric encryption to exchange a symmetric key rather than encrypting the entire message with asymmetric encryption?

   • ASymmetric encryption cannot be used for large data volumes.
   • BAsymmetric encryption provides better confidentiality than symmetric encryption.
   • CAsymmetric encryption is faster for large data volumes.
   • DAsymmetric encryption is used to securely share a symmetric key, and symmetric encryption handles the bulk data efficiently.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security tester is evaluating a database that stores customer PII. The database uses transparent data encryption (TDE) to encrypt the data at rest. The tester wants to verify that the encryption is effective. What should the tester do?

   • AInspect the database configuration to confirm that TDE is enabled and that the encryption algorithm is AES-256.
   • BVerify that the encryption keys are stored in a hardware security module (HSM) and are not accessible to database administrators.
   • CQuery the database and confirm that the data is returned in an encrypted format.
   • DCheck that the database files are encrypted by attempting to read them directly from the file system.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common symmetric encryption algorithm?

   • AAES
   • BRSA
   • CSHA-256
   • DECDSA
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A security tester is performing a penetration test on a web application. The tester intercepts a request and sees that the password is sent in plaintext. The application uses HTTPS, but the tester suspects that the password is also stored in plaintext. What is the most effective way to test for plaintext storage?

   • AAttempt to access the database directly to see if passwords are stored in plaintext.
   • BUse a SQL injection attack to extract the password hashes from the database.
   • CCheck the application's source code to see how passwords are stored.
   • DCreate an account and then attempt to retrieve the password through a password reset or account recovery feature.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a technique used to test encryption implementation?

   • ADeleting the encryption keys to see if the system fails
   • BPerforming a denial-of-service attack on the encryption service
   • CReviewing the source code to check for hardcoded keys
   • DUsing a password cracker to guess user passwords
   Reveal Solution Discussion Select an answer first