Module 20 - Cryptography ( EC Mode )

Question 1

Which of the following objectives of cryptography defines the trustworthiness of data or resources in terms of preventing improper and unauthorized changes?

A. Integrity
B. Confidentiality
C. Nonrepudiation
D. Authentication

Answer 1

Answer: A. Integrity

Explanation:
Objectives of Cryptography

Confidentiality: Assurance that the information is accessible only to those authorized to access it.
Integrity: Trustworthiness of data or resources in terms of preventing improper and unauthorized changes.
Nonrepudiation: Guarantee that the sender of a message cannot later deny having sent the message and that the recipient cannot deny having received the message.
Authentication: Assurance that the communication, document, or data is genuine.

Question 2

Which of the following objectives of cryptography ensures that information is accessible only to those who are authorized to access it?

A. Integrity
B. Authentication
C. Confidentiality
D. Nonrepudiation

Answer 2

Answer: C. Confidentiality

Explanation:
Integrity: Trustworthiness of data or resources in terms of preventing improper and unauthorized changes.
Authentication: Assurance that the communication, document, or data is genuine.
Confidentiality: Assurance that the information is accessible only to those authorized to access it.
Nonrepudiation: Guarantee that the sender of a message cannot later deny having sent the message and that the recipient cannot deny having received the message.

Question 3

The fundamental difference between symmetric and asymmetric key cryptographic systems is that symmetric key cryptography uses__________________?

A. Different keys on both ends of the transport medium
B. The same key on each end of the transmission medium
C. Multiple keys for nonrepudiation of bulk data
D. Bulk encryption for data transmission over fiber

Answer 3

Answer: B. The same key on each end of the transmission medium

Explanation:
Symmetric cryptographic systems are those in which the sender and receiver of a message share a single common key that is used to encrypt and decrypt the message.

Question 4

Which of the following describes a component of public key infrastructure (PKI) where a copy of a private key is stored to provide third-party access and to facilitate recovery operations?

A. Key registry
B. Key escrow
C. Recovery agent
D. Directory

Answer 4

Answer: B. Key escrow

Explanation:
The correct answer is (d). Key escrow is a key exchange arrangement in which essential cryptographic keys are stored with a third party in escrow. The third party can use or allow others to use the encryption keys under certain predefined circumstances.

Question 5

Which of the following tools helps users compress, encrypt, and convert plaintext data into ciphertext using symmetric and public-key algorithms?

A. HashMyFiles
B. Hash Driod
C. MD5 Calculator
D. BCTextEncoder

Answer 5

Answer: D. BCTextEncoder

Explanation:
BCTextEncoder: The BCTextEncoder utility simplifies the encoding and decoding of text data. It compresses, encrypts, and converts plaintext data into text format, which the user can then copy to the clipboard or save as a text file. It uses public key encryption methods as well as password-based encryption. Furthermore, it uses strong and approved symmetric and public-key algorithms for data encryption.
Hash Droid: The Hash Droid utility helps to calculate a hash from a given text or a file stored on the device. In this application, the available hash functions are Adler-32, CRC-32, Haval-128, MD2, MD4, MD5, RIPEMD-128, RIPEMD-160, SHA-1, SHA-256, SHA-384, SHA-512, Tiger, and Whirlpool
MD5 Calculator: MD5 Calculator is a simple application that calculates the MD5 hash of a given file. It can be used with large files (e.g., several gigabytes in size). It features a progress counter and a text field from which the final MD5 hash can be easily copied to the clipboard. MD5 Calculator can be used to check the integrity of a file.
HashMyFiles: HashMyFiles is a utility that allows you to calculate the MD5 and SHA1 hashes of one or more files in the system. It allows you to copy the MD5/SHA1 hash list to the clipboard or save it in a text/html/xml file. You can launch HashMyFiles from the context menu of Windows Explorer and display the MD5/SHA1 hashes of the selected files or folders.

Question 6

In one of the following types of cipher, letters in plaintext are rearranged according to a regular system to produce ciphertext. Which is this type of cipher?

A. Transposition cipher
B. Stream cipher
C. Block cipher
D. Substitution cipher

Answer 6

Answer: A. Transposition cipher

Explanation:
Substitution cipher: The user replaces units of plaintext with ciphertext according to a regular system. The units may be single letters, pairs of letters, or combinations of them, and so on
Block cipher: Deterministic algorithms operating on a block (a group of bits) of fixed size with an unvarying transformation specified by a symmetric key. Most modern ciphers are block ciphers
Transposition cipher: Here, letters in the plaintext are rearranged according to a regular system to produce the ciphertext. For example, “CRYPTOGRAPHY” when encrypted becomes “AOYCRGPTYRHP.”
Stream cipher: Symmetric-key ciphers are plaintext digits combined with a key stream (pseudorandom cipher digit stream). Here, the user applies the key to each bit, one at a time. Examples include RC4, SEAL, etc.

Question 7

Which of the following encryption algorithms is also called Magma and is a symmetric-key block cipher having a 32-round Feistel network working on 64-bit blocks with a key length of 256 bits?

A. Serpent
B. GOST
C. TEA
D. Camellia

Answer 7

Answer: B. GOST

Explanation:
Camellia: Camellia is a symmetric-key block cipher having either 18 rounds (for 128-bit keys) or 24 rounds (for 256-bit keys). It is a Feistel cipher with a block size of 128 bits and a key size of 128, 192, and 256 bits. Camellia uses four 8×8-bit S-boxes that perform affine transformations and logical operations. A logical transformation layer FL-function or its inverse is applied every six rounds
TEA: The tiny encryption algorithm (TEA) was created by David Wheeler and Roger Needham, and it was publicly presented for the first time in 1994. It is a simple algorithm, easy to implement in code. It is a Feistel cipher that uses 64 rounds
GOST Block Cipher: The GOST (Government Standard) block cipher, also called Magma, is a symmetric-key block cipher having a 32-round Feistel network working on 64-bit blocks with a 256-bit key length. It consists of an S-box that can be kept secret and it contains around 354 bits of secret information. GOST is a simple encryption algorithm, where the round function 32-bit subkey modulo 232 is added and put in the layer of S-boxes and the rotate left shift operation is used for shifting 11 bits, thereby providing the output of the round function.
Serpent: Serpent is a symmetric-key block cipher that was a finalist in the AES contest. This algorithm was designed by Ross Anderson, Eli Biham, and Lars Knudsen. It uses a 128-bit symmetric block cipher with key sizes of 128, 192, or 256 bits. It can be integrated into software or hardware programs without any restrictions. Serpent involves 32 rounds of computational operations that include substitution and permutation operations on four 32-bit word blocks using 8-variable S-boxes with 4-bit entry and 4-bit exit

Question 8

Which of the following types of hardware encryption devices is a crypto-processor or chip present in the motherboard that can securely store encryption keys and perform many cryptographic operations?

A. TPM
B. HSM
C. Hard-drive encryption
D. USB encryption

Answer 8

Answer: A. TPM (Trusted Platform Module)

Explanation:
HSM: Hardware security module (HSM) is an additional external security device that is used in a system for crypto-processing and can be used for managing, generating, and securely storing cryptographic keys
TPM: Trusted platform module (TPM) is a crypto-processor or chip that is present on the motherboard that can securely store the encryption keys, and it can perform many cryptographic operations
USB Encryption: USB encryption is an additional feature for USB storage devices that offers onboard encryption services
Hard Drive Encryption: Hard drive encryption is a technology where the data stored in the hardware can be encrypted using a wide range of encryption options

Question 9

Which of the following is an encryption technique where math operations are performed to encrypt plaintext, allowing users to secure and leave their data in an encrypted format even while the data are being processed or manipulated?

A. Hardware-based encryption
B. Quantum cryptography
C. Elliptic curve cryptography
D. Homomorphic encryption

Answer 9

Answer: D. Homomorphic encryption

Explanation:
Elliptic Curve Cryptography (ECC): ECC is a modern public-key cryptography developed to avoid larger cryptographic key usage. The asymmetric cryptosystem depends on number theory and mathematical elliptic curves (algebraic structure) to generate short, quick, and robust cryptographic keys. RSA is an incumbent public-key algorithm, but its key size is large. The speed of the encryption always depends on the key size: a smaller key length allows faster encryption. To minimize the key size, elliptic curve cryptography has been proposed as a replacement for the RSA algorithm
Quantum Cryptography: In quantum cryptography, the data are encrypted by a sequence of photons that have a spinning trait while traveling from one end to another end. These photons keep changing their shapes during their course through filters: vertical, horizontal, forward slash, and backslash. Here, vertical and backslash spins imply “ones,” while horizontal and forward slash spins imply “zeros.”
Homomorphic Encryption: Homomorphic encryption differs from conventional encryption mechanisms, where math operations are performed to encrypt the plaintext. Homographic encryption allows users to secure and leave their data in an encrypted format even while it is being processed or manipulated. In this technique, encryption and decryption are performed by the same key holder
Hardware-based Encryption: Hardware-based encryption is a technique that uses computer hardware for assisting or replacing the software when the data encryption process is being performed. Devices that offer encryption techniques can be considered as hardware-based encryption devices.

Question 10

Which of the following symmetric-key block ciphers uses a 128-bit symmetric block cipher with key sizes of 128, 192, and 256 bits and can be easily integrated into software or hardware programs without any restrictions?

A. RC6
B. TEA
C. Serpent
D. Blowfish

Answer 10

Answer: C. Serpent

Explanation:
Serpent: Like Blowfish, Serpent is a symmetric-key block cipher that was a finalist in the AES contest. This algorithm was designed by Ross Anderson, Eli Biham, and Lars Knudsen. It uses a 128-bit symmetric block cipher with key sizes of 128, 192, or 256 bits. It can be integrated into software or hardware programs without any restrictions.
TEA: The tiny encryption algorithm (TEA) was created by David Wheeler and Roger Needham, and it was publicly presented for the first time in 1994. It is a simple algorithm, easy to implement in code. It is a Feistel cipher that uses 64 rounds (note that this is a suggestion; it can be implemented with fewer or more rounds). The number of rounds should be even since they are implemented in pairs called cycles.
Blowfish: Blowfish is a type of symmetric block cipher algorithm designed to replace DES or IDEA algorithms. It uses the same secret key to encrypt and decrypt data. This algorithm splits the data into a block length of 64 bits and produces a key ranging from 32 bits to 448 bits.
RC6: RC6 is a symmetric-key block cipher derived from RC5. It is a parameterized algorithm with a variable block size, key size, and number of rounds.

Question 11

Which of the following symmetric-key block ciphers has either 18 rounds for 128-bit keys or 24 rounds for 256-bit keys and uses four 8 × 8-bit S-boxes that perform affine transformations and logical operations?

A. Diffie–Hellman
B. Camellia
C. YAK
D. RSA

Answer 11

Answer: Camellia.

Explanation:
RSA: Ron Rivest, Adi Shamir, and Leonard Adleman formulated RSA, a public-key cryptosystem for Internet encryption and authentication. RSA uses modular arithmetic and elementary number theories to perform computations using two large prime numbers.
Diffie–Hellman: It is a cryptographic protocol that allows two parties to establish a shared key over an insecure channel.
Camellia: Camellia is a symmetric-key block cipher having either 18 rounds (for 128-bit keys) or 24 rounds (for 256-bit keys). It is a Feistel cipher with a block size of 128 bits and a key size of 128, 192, and 256 bits. Camellia uses four 8×8-bit S-boxes that perform affine transformations and logical operations.
YAK: It is a public-key-based Authenticated Key Exchange (AKE) protocol. The authentication of YAK is based on public key pairs, and it needs PKI to distribute authentic public keys.

Question 12

Which of the following algorithms uses a sponge construction where message blocks are XORed into the initial bits of the state that the algorithm then invertibly permutes?

A. SHA-3
B. SHA-2
C. MD6
D. MD5

Answer 12

Answer: SHA-3.

Explanation:
MD5 is a widely used cryptographic hash function that takes a message of arbitrary length as input and outputs a 128-bit (16-byte) fingerprint or message digest of the input. MD5 can be used in a wide variety of cryptographic applications and is useful for digital signature applications, file integrity checking, and storing passwords..
SHA-3: SHA-3 uses sponge construction in which message blocks are XORed into the initial bits of the state, which the algorithm then invertibly permutes. It supports the same hash lengths as SHA-2 but differs in its internal structure considerably from the rest of the SHA family.
MD6: It uses a Merkle-tree-like structure to allow for large-scale parallel computation of hashes for very long inputs. It is resistant to differential cryptanalysis attacks.
SHA-2: SHA2 is a family of two similar hash functions with different block sizes, namely SHA-256, which uses 32-bit words, and SHA-512, which uses 64-bit words. The truncated versions of each standard are SHA-224 and SHA-384.

Question 13

Which of the following hardware encryption devices is an additional external security device used in a system for crypto-processing and can be used for managing, generating, and securely storing cryptographic keys?

A. Hard-drive encryption
B. TPM
C. HSM
D. USB encryption

Answer 13

Answer: HSM (Hardware Security Module).

Explanation:
Types of hardware encryption devices

USB Encryption: USB encryption is an additional feature for USB storage devices, which offers onboard encryption services. Encrypted USB devices need an on-device credential system or software- or hardware-based credentials from a computer. USB encryption provides protection against malware distribution over USB and helps in preventing data loss and data leakage. Some hardware USB-encrypted devices include Crypto USB, Kingston Ironkey D300S, and diskAshur Pro 500GB.
Hard Drive Encryption: Hard drive encryption is a technology whereby the data stored in the hardware can be encrypted using a wide range of encryption options. Hard drive encryption devices cannot use an on-device keyboard or fingerprint reader; instead, they need a TPM or an HSM. These devices can be installed as an internal drive on a computer. Some hard drive encryption devices include military-grade 256-bit AES Hardware Encryption and DiskCypher AES Sata Hard Drive Encryption.
TPM: Trusted Platform Module (TPM) is a crypto-processor or a chip that is present in the motherboard. It can securely store the encryption keys and perform many cryptographic operations. TPM offers various features such as authenticating platform integrity, providing full disk encryption capabilities, performing password storage, and providing software license protection.
HSM: A hardware security module (HSM) is an additional external security device that is used in a system for crypto-processing, and it can be used for managing, generating, and securely storing cryptographic keys. HSM offers enhanced encryption computation that is useful for symmetric keys longer than 256 bits. High-performance HSM devices are connected to the network using TCP/IP. Some HSM devices include SafeNet Luna Network HSM, nSheild, Cloud HSM, and Cryptosec Dekaton.

Question 14

Some passwords are stored using specialized encryption algorithms known as hashes. Why is this an appropriate method?

A. It is impossible to crack hashed user passwords unless the key used to encrypt them is obtained.
B. Passwords stored using hashes are nonreversible, making finding the password much more difficult.
C. If a user forgets the password, it can be easily retrieved using the hash key stored by administrators.
D. Hashing is faster when compared to more traditional encryption algorithms.

Answer 14

Answer: Passwords stored using hashes are nonreversible, making finding the password much more difficult.

Explanation:
A password hash is an encrypted sequence of characters obtained after applying certain algorithms and manipulations on a user provided password.

Question 15

After gaining access to the password hashes used to protect access to a web-based application, the knowledge of which cryptographic algorithms would be useful to gain access to the application?

A. SHA1
B. Diffie–Helman
C. AES
D. RSA

Answer 15

Answer: SHA1.

Explanation:
The correct answer is (a)’ SHA-1 is a 160-bit hash function that resembles the former MD5 algorithm developed by Ron Rivest. It produces a 160-bit digest from a message with a maximum length of (264 − 1) bits. It was designed by the National Security Agency (NSA) to be part of the digital signature algorithm (DSA) and is most commonly used in security protocols such as PGP, TLS, SSH, and SSL. As of 2010, SHA-1 is no longer approved for cryptographic use because of cryptographic weaknesses.

Question 16

Which cipher encrypts the plain text digit (bit or byte) one by one?

A. Classical cipher
B. Modern cipher
C. Block cipher
D. Stream cipher

Answer 16

Answer: Stream cipher.

Explanation:
Classical ciphers: Classical ciphers are the most basic type of ciphers, which operate on alphabets (A-Z). Implementation of these ciphers is generally either by hand or with simple mechanical devices.
Block ciphers: Block ciphers determine algorithms operating on a block (group of bits) of fixed size with an unvarying transformation specified by a symmetric key.
Modern ciphers: The user can calculate the Modern ciphers with the help of a one-way mathematical function that is capable of factoring large prime numbers.
Stream ciphers: Symmetric key ciphers are plaintext digits combined with a key stream (pseudorandom cipher digit stream). Here, the user applies the key to each bit, one at a time. Examples include RC4, SEAL, etc.

Question 17

Which property ensures that a hash function will not produce the same hashed value for two different messages?

A. Entropy
B. Collision resistance
C. Bit length
D. Key strength

Answer 17

Answer: Collision resistance.

Explanation:
Collision resistance is a property of cryptographic hash functions. A hash function H is collision resistant if it is hard to find two inputs that hash to the same output, that is, two inputs a and b such that H(a) = H(b), and a≠b.
Every hash function with more inputs than outputs will necessarily have collisions. Consider a hash function such as SHA-256 that produces 256 bits of output from an arbitrarily large input. Since it must generate one of 2256 outputs for each member of a much larger set of inputs, the pigeonhole principle guarantees that some inputs will hash to the same output. Collision resistance does not mean that no collisions exist; they are just simply hard to find.

Question 18

Which of the following is optimized for confidential communications, such as bidirectional voice and video?

A. MD5
B. MD4
C. RC5
D. RC4

Answer 18

Answer: RC4.

Explanation:
RC4 is a variable key-size symmetric-key stream cipher with byte-oriented operations and it depends on the use of a random permutation. According to some analyses, the period of the cipher is likely to be greater than 10,100. Each output byte uses 8–16 system operations, meaning the cipher has the ability to run fast when used in software. Products like RSA SecurPC use this algorithm for file encryption. RC4 enables safe communications such as traffic encryption (which secures websites) and for websites that use the SSL protocol.

Question 19

What is the primary drawback of using Advanced Encryption Standard (AES) algorithm with a 256-bit key to share sensitive data?

A. To get messaging programs to function with this algorithm requires complex configurations.
B. It is a symmetric key algorithm, meaning each recipient must receive the key through a different channel than the message.
C. It has been proven to be a weak cipher; therefore, should not be trusted to protect sensitive data.
D. Due to the key size, the time it will take to encrypt and decrypt the message hinders efficient communication.

Answer 19

Answer: B. It is a symmetric key algorithm, meaning each recipient must receive the key through a different channel than the message.

Explanation:

Some of the other drawbacks of AES algorithm are as follows:

It uses a too simple algebraic structure.
Every block is always encrypted in the same way.
It is hard to implement with software.
AES in counter mode is complex to implement in software taking both performance and security into consideration.

Question 20

When setting up a wireless network, an administrator enters a preshared key for security. Which of the following is true?

A. The key is an RSA key used to encrypt the wireless data.
B. The key entered is based on the Diffie–Hellman method.
C. The key entered is a symmetric key used to encrypt the wireless data.
D. The key entered is a hash that is used to prove the integrity of the wireless data.

Answer 20

Answer: The key entered is a symmetric key used to encrypt the wireless data.

Explanation:
Symmetric encryption requires that both the sender and the receiver of the message possess the same encryption key. The sender uses a key to encrypt the plaintext and sends the resultant ciphertext to the recipient, who uses the same key (used for encryption) to decrypt the ciphertext into plaintext. Symmetric encryption is also known as secret key cryptography as it uses only one secret key to encrypt and decrypt the data. This kind of cryptography works well when you are communicating with only a few people.

Question 21

In a cipher mode of operation, the initialization vector (IV) stored in the shift register is sent as input to the encryption algorithm along with the secret key. From the result of encryption, the first S bits are selected to perform XOR with a plaintext block of size S to produce a cipher block. Identify this cipher mode of operation.

A. Counter mode
B. Cipher block chaining (CBC) mode
C. Cipher feedback (CFB) mode
D. Electronic code book (ECB) mode

Answer 21

Answer: Cipher feedback (CFB) mode.

Explanation:
Counter Mode: The counter mode is a block cipher mode of operation that uses a counter value in the encryption and decryption process. A counter value is initiated and sent as the input to the block cipher encryption algorithm with a secret key, and the result is subjected to the XOR operation with a block of plaintext. The output is the ciphertext block. This process is performed in a sequential manner to encrypt all the other plaintext blocks.
Electronic Code Book (ECB) Mode: The plaintext is divided into a fixed length of blocks, which is equal to the size of the secret key. In the first stage, the encryption starts by taking the first block of the plaintext, and the secret key is taken as input to the block cipher encryption algorithm; the output is the first block of ciphertext. The process is repeated for all the plaintext blocks.
Cipher Feedback (CFB) Mode: In the CFB mode, previously generated ciphertext is used as feedback for the encryption algorithm to encrypt the next plaintext block to ciphertext. First, the initialization vector (IV) is stored in a shift register and sent to the encryption algorithm, along with a secret key. From the result of that encryption, the first S bits are selected, and the XOR operation is performed with a plaintext block of size S. The resultant output is the ciphertext block. For the next encryption block, the previous cipher block is given as the input to the shift register; it shifts S bits to the left, and the process is continued till the end of the plaintext.
Cipher Block Chaining (CBC) Mode: First, the plaintext is divided into blocks of the same size. The first block is XOR with the initialization vector (IV), and the resultant is sent as input to the block cipher encryption algorithm, along with the secret key. The output is the first block of ciphertext. This cipher block is used to perform XOR with the next plaintext block; the chain process continues till the last block of plaintext.

Question 22

In a mode of authenticated encryption, the plaintext is first encrypted using a secret key. Then, a hash value is generated for the obtained cipher text and is attached to the cipher text before transmission. Identify this mode of authenticated encryption.

A. Authenticated encryption with associated data (AEAD)
B. Encrypt-then-MAC (EtM)
C. Encrypt-and-MAC (E&M)
D. MAC-then-Encrypt (MtE)

Answer: B. Encrypt-then-MAC (EtM)

Explanation:
Encrypt-and-MAC (E&M): In the E&M approach, a MAC is first generated for the plaintext, following which the plaintext is encrypted using a secret key. Finally, both the ciphertext and MAC are combined and transmitted.
Encrypt-then-MAC (EtM): In this approach, the plaintext is first encrypted using a secret key. For the obtained ciphertext, a hash value called message authentication code (MAC) is generated. The MAC is attached to the ciphertext and transmitted.
Authenticated encryption with associated data (AEAD): This approach adds additional data to the ciphertext at certain places to thwart chosen ciphertext attacks. The message header is kept unencrypted so that the receiver can verify the source of the message, and the payload is encrypted to ensure confidentiality.
MAC-then-Encrypt (MtE): In the MtE approach, a MAC is first generated for the plaintext using the hash function, and the MAC is combined with the plaintext. The combination of the plaintext and MAC is encrypted with a secret key to produce ciphertext. The ciphertext contains the encrypted MAC.

Answer 22

Answer: B. Encrypt-then-MAC (EtM)

Explanation:
Encrypt-and-MAC (E&M): In the E&M approach, a MAC is first generated for the plaintext, following which the plaintext is encrypted using a secret key. Finally, both the ciphertext and MAC are combined and transmitted.
Encrypt-then-MAC (EtM): In this approach, the plaintext is first encrypted using a secret key. For the obtained ciphertext, a hash value called message authentication code (MAC) is generated. The MAC is attached to the ciphertext and transmitted.
Authenticated encryption with associated data (AEAD): This approach adds additional data to the ciphertext at certain places to thwart chosen ciphertext attacks. The message header is kept unencrypted so that the receiver can verify the source of the message, and the payload is encrypted to ensure confidentiality.
MAC-then-Encrypt (MtE): In the MtE approach, a MAC is first generated for the plaintext using the hash function, and the MAC is combined with the plaintext. The combination of the plaintext and MAC is encrypted with a secret key to produce ciphertext. The ciphertext contains the encrypted MAC.

Question 23

In a mode of authenticated encryption, a hash code is first generated. Next, the plaintext is encrypted using a secret key. Finally, both the cipher text and hash value are combined and transmitted. Identify this mode of authenticated encryption.

A. Authenticated encryption with associated data (AEAD)
B. Encrypt-and-MAC (E&M)
C. MAC-then-Encrypt (MtE)
D. Encrypt-then-MAC (EtM)

Answer 23

Answer: B. Encrypt-and-MAC (E&M)

Explanation:
Encrypt-then-MAC (EtM): In this approach, the plaintext is first encrypted using a secret key. For the obtained ciphertext, a hash value called message authentication code (MAC) is generated. The MAC is attached to the ciphertext and transmitted.
MAC-then-Encrypt (MtE): In the MtE approach, a MAC is first generated for the plaintext using the hash function, and the MAC is combined with the plaintext. The combination of the plaintext and MAC is encrypted with a secret key to produce ciphertext. The ciphertext contains the encrypted MAC.
Authenticated encryption with associated data (AEAD): This approach adds additional data to the ciphertext at certain places to thwart chosen ciphertext attacks. The message header is kept unencrypted so that the receiver can verify the source of the message, and the payload is encrypted to ensure confidentiality.
Encrypt-and-MAC (E&M): In the E&M approach, a MAC is first generated for the plaintext, following which the plaintext is encrypted using a secret key. Finally, both the ciphertext and MAC are combined and transmitted.

Question 24

Identify the type of blockchain in which a supervisor or central authority decides who can join and participate in the blockchain network.

A. Federated blockchain
B. Hybrid blockchain
C. Private ledger
D. Public blockchain

Answer 24

Answer: C. Private ledger

Explanation:
Federated blockchain or consortium blockchain: It is a partially decentralized blockchain in which a group of individuals or organizations, rather than a single entity as in private blockchains, create and manage separate blockchain networks. Control over the blockchain is provided to a group of predetermined or trusted nodes.
Hybrid blockchain: It is a combination of both private and public blockchain. In a hybrid blockchain, only a selected set of records or data from the blockchain can be publicly accessed; the remaining data are kept confidential in a private network. This type of blockchain enables organizations to select which data they wish to make public private.
Public ledger or public blockchain: This type of blockchain has no central authority or administration to manage the blocks or ledgers. It is a decentralized and permission-less network in which anyone can join, create, and share blocks. Once the data on the blockchain have been validated, it is secure from modifications or alterations.
Private ledger or private blockchain: In this type of blockchain, a supervisor or central authority decides who can join and participate in the blockchain network. In a private ledger, only the members involved in a transaction will have knowledge about the corresponding ledgers.

Question 25

Which of the following is an example of a public ledger or public blockchain that has no central authority or administration to manage the blocks or ledgers?

A. Ripple (XRP)
B. Hyperledger
C. Ethereum
D. IBM Food Trust

Answer 25

Answer: Ethereum.

Explanation:
Ethereum: Some examples of public blockchains include Bitcoin and Ethereum.
Ripple (XRP) and Hyperledger: Some examples of private blockchains are Hyperledger and Ripple (XRP).
IBM Food Trust: One important example of a hybrid blockchain is the IBM Food Trust.

Question 26

Which of the following cryptographic algorithms has been proposed as a replacement for the RSA algorithm to minimize the key size?

A. Quantum cryptography
B. ECC
C. HMAC
D. RIPEMD-160

Answer 26

Answer: ECC (Elliptic Curve Cryptography).

Explanation:
HMAC: Hash-based message authentication code (HMAC) is a type of message authentication code (MAC) that uses a cryptographic key along with a cryptographic hash function. It is widely used to verify the integrity of data and authentication of a message. This algorithm includes an embedded hash function such as SHA-1 or MD5. The strength of HMAC depends on the embedded hash function, key size, and size of the hash output.
Elliptic Curve Cryptography (ECC): ECC is a modern public-key cryptography developed to avoid larger cryptographic key usage. The asymmetric cryptosystem depends on number theory and mathematical elliptic curves (algebraic structure) to generate short, quick, and robust cryptographic keys. RSA is an incumbent public-key algorithm, but its key size is large. The speed of the encryption always depends on the key size: a smaller key length allows faster encryption. To minimize the key size, elliptic curve cryptography has been proposed as a replacement for the RSA algorithm.
RIPEMD-160: RACE Integrity Primitives Evaluation Message Digest (RIPEMD) is a 160-bit hash algorithm developed by Hans Dobbertin, Antoon Bosselaers, and Bart Preneel. There exist 128-, 256-, and 320-bit versions of this algorithm, called RIPEMD-128, RIPEMD-256, and RIPEMD-320, respectively. These algorithms replace the original RIPEMD, which was found to have a collision issue. They do not follow any standard security policies or guidelines.
Quantum Cryptography: In quantum cryptography, the data are encrypted by a sequence of photons that have a spinning trait while traveling from one end to another end. These photons keep changing their shapes during their course through filters: vertical, horizontal, forward slash, and backslash.

Question 27

Which of the following algorithms provides better protection against brute force attacks by using a 160-bit message digest?

A. RC4
B. MD5
C. MD4
D. SHA-1

Answer 27

Answer: SHA-1.

Explanation:
MD5 can be cracked by brute-force attack and suffers from extensive vulnerabilities. RC4 is ideal for software implementation. MD4 is used to verify data integrity through the creation of a 128-bit message digest from data input.

Question 28

In a mode of authenticated encryption, a hash value is first generated for the plaintext. Then, both the plaintext and hash value are combined and encrypted with a secret key to produce cipher text. Identify this mode of authenticated encryption.

A. Encrypt-and-MAC (E&M)
B. Encrypt-then-MAC (EtM)
C. MAC-then-Encrypt (MtE)
D. Authenticated encryption with associated data (AEAD)

Answer 28

Answer: MAC-then-Encrypt (MtE)

Explanation:
Authenticated encryption with associated data (AEAD): This approach adds additional data to the ciphertext at certain places to thwart chosen ciphertext attacks. The message header is kept unencrypted so that the receiver can verify the source of the message, and the payload is encrypted to ensure confidentiality.
MAC-then-Encrypt (MtE): In the MtE approach, a MAC is first generated for the plaintext using the hash function, and the MAC is combined with the plaintext. The combination of the plaintext and MAC is encrypted with a secret key to produce ciphertext. The ciphertext contains the encrypted MAC.
Encrypt-and-MAC (E&M): In the E&M approach, a MAC is first generated for the plaintext, following which the plaintext is encrypted using a secret key. Finally, both the ciphertext and MAC are combined and transmitted.
Encrypt-then-MAC (EtM): In this approach, the plaintext is first encrypted using a secret key. For the obtained ciphertext, a hash value called message authentication code (MAC) is generated. The MAC is attached to the ciphertext and transmitted.

Question 29

Which of the following is a partially decentralized blockchain in which a group of individuals or organizations create and manage separate blockchain networks?

A. Hybrid blockchain
B. Federated blockchain
C. Public ledger
D. Private blockchain

Answer 29

Answer: Federated blockchain.

Explanation:
Federated blockchain or consortium blockchain: It is a partially decentralized blockchain in which a group of individuals or organizations, rather than a single entity as in private blockchains, create and manage separate blockchain networks. Control over the blockchain is provided to a group of predetermined or trusted nodes.
Public ledger or public blockchain: This type of blockchain has no central authority or administration to manage the blocks or ledgers. It is a decentralized and permission-less network in which anyone can join, create, and share blocks. Once the data on the blockchain have been validated, it is secure from modifications or alterations.
Private ledger or private blockchain: In this type of blockchain, a supervisor or central authority decides who can join and participate in the blockchain network. In a private ledger, only the members involved in a transaction will have knowledge about the corresponding ledgers.
Hybrid blockchain: It is a combination of both private and public blockchain. In a hybrid blockchain, only a selected set of records or data from the blockchain can be publicly accessed; the remaining data are kept confidential in a private network. This type of blockchain enables organizations to select which data they wish to make public private.

Question 30

Which of the following is an example of a private blockchain where a supervisor or central authority decides who can join and participate in the blockchain network?

A. IBM Food Trust
B. Ethereum
C. Ripple (XRP)
D. Bitcoin

Answer 30

Answer: Ripple (XRP)

Explanation:
Ethereum and Bitcoin: Some examples of public blockchains include Bitcoin and Ethereum.
IBM Food Trust: One important example of a hybrid blockchain is the IBM Food Trust.
Ripple (XRP): Some examples of private blockchains are Hyperledger and Ripple (XRP).

Question 31

Identify the type of blockchain in which there is no central authority or administration to manage the blocks or ledgers.

A. Hybrid blockchain
B. Public blockchain
C. Federated blockchain
D. Private ledger

Answer 31

Answer: Public blockchain.

Explanation:
Private ledger or private blockchain: In this type of blockchain, a supervisor or central authority decides who can join and participate in the blockchain network. In a private ledger, only the members involved in a transaction will have knowledge about the corresponding ledgers.
Federated blockchain or consortium blockchain: It is a partially decentralized blockchain in which a group of individuals or organizations, rather than a single entity as in private blockchains, create and manage separate blockchain networks. Control over the blockchain is provided to a group of predetermined or trusted nodes.
Public ledger or public blockchain: This type of blockchain has no central authority or administration to manage the blocks or ledgers. It is a decentralized and permission-less network in which anyone can join, create, and share blocks. Once the data on the blockchain have been validated, it is secure from modifications or alterations.
Hybrid blockchain: It is a combination of both private and public blockchain. In a hybrid blockchain, only a selected set of records or data from the blockchain can be publicly accessed; the remaining data are kept confidential in a private network. This type of blockchain enables organizations to select which data they wish to make public private.

Question 32

Which of the following is a decentralized and permission-less network in which anyone can join, create, and share blocks?

A. Private blockchain
B. Public ledger
C. Consortium blockchain
D. Hybrid blockchain

Answer 32

Answer: Public ledger.

Explanation:
Federated blockchain or consortium blockchain: It is a partially decentralized blockchain in which a group of individuals or organizations, rather than a single entity as in private blockchains, create and manage separate blockchain networks. Control over the blockchain is provided to a group of predetermined or trusted nodes.
Public ledger or public blockchain: This type of blockchain has no central authority or administration to manage the blocks or ledgers. It is a decentralized and permission-less network in which anyone can join, create, and share blocks. Once the data on the blockchain have been validated, it is secure from modifications or alterations.
Hybrid blockchain: It is a combination of both private and public blockchain. In a hybrid blockchain, only a selected set of records or data from the blockchain can be publicly accessed; the remaining data are kept confidential in a private network. This type of blockchain enables organizations to select which data they wish to make public private.
Private ledger or private blockchain: In this type of blockchain, a supervisor or central authority decides who can join and participate in the blockchain network. In a private ledger, only the members involved in a transaction will have knowledge about the corresponding ledgers.

Question 33

Which of the following defines the role of a root certificate authority (CA) in a public key infrastructure (PKI)?

A. The root CA is the recovery agent used to encrypt data when a user’s certificate is lost.
B. The root CA stores the user’s hash value for safekeeping.
C. The CA is the trusted root that issues certificates.
D. The root CA is used to encrypt e-mail messages to prevent unintended disclosure of data.

Answer 33

Answer: The CA is the trusted root that issues certificates.

Explanation:
A certificate authority can issue multiple certificates in the form of a tree structure. A root certificate is the top-most certificate of the tree; the private key that is used to “sign” other certificates. All certificates signed by the root certificate, with the “CA” field set to true, inherit the trustworthiness of the root certificate – a signature by a root certificate is somewhat analogous to “notarizing” an identity in the physical world. Such a certificate is called an intermediate certificate or subordinate CA certificate. Certificates further down the tree also depend on the trustworthiness of the intermediates.

Question 34

Which of the following is a characteristic of public key infrastructure (PKI)?

A. Public-key cryptosystems are faster than symmetric-key cryptosystems.
B. Public-key cryptosystems distribute public-keys within digital signatures.
C. Public-key cryptosystems do not provide technical nonrepudiation via digital signatures.
D. Public-key cryptosystems do not require a secure key distribution channel.

Answer 34

Answer: Public-key cryptosystems distribute public-keys within digital signatures.

Explanation:
Public-key cryptography and the public-key/private-key pair provides an important benefit: the ability to widely distribute the public key on a server, or in a central directory, without jeopardizing the integrity of the private key component of the key pair. This eliminates the need to transmit the public key to every correspondent in the system.

Question 35

A network security administrator is worried about potential man-in-the-middle attacks when users access a corporate website from their workstations. Which of the following is the best remediation against this type of attack?

A. Requiring strong authentication for all DNS queries
B. Requiring client and server PKI certificates for all connections
C. Implementing server-side PKI certificates for all connections
D. Mandating only client-side PKI certificates for all connections

Answer 35

Answer: Requiring client and server PKI certificates for all connections.

Explanation:
A man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. PKI certificates can be used to encrypt traffic between a client and the server. In this scenario, even if an attacker successfully sniffs the network, it will be difficult to decode the authentication tokens or cookies required for a MITM attack.
Both server and client certificates encompass the “Issued to” section. Here, for server certificate the “Issued to” section’s value will be the hostname for which it has to be issued and for the client certificate, it will be the user identity or the user name. Both client and server certificates are a significant indication for trust and safe transactions or accessing a website.

Question 36

Which element of public key infrastructure (PKI) verifies the applicant?

A. Certificate authority
B. Registration authority
C. Validation authority
D. Verification authority

Answer 36

Answer: Registration authority.

Explanation:
The correct answer is (c). Registration authority (RA): This acts as the verifier for the certificate authority.
The PKI role that assures valid and correct registration is called a registration authority (RA). An RA is responsible for accepting requests for digital certificates and authenticating the entity making the request. In a Microsoft PKI, a registration authority is usually called a subordinate CA.

Question 37

Steve is the new CISO for a global corporation; he hired Dayna as a security consultant to do a security assessment. Steve wants to protect the corporate webpage with encryption and asks Dayna about the procedure to do that. Which of the following is the correct option?

A. You need to use Blowfish encryption.
B. You need to use digital certificates.
C. You need to use quantum encryption.
D. You need to use digital signature.

Answer 37

Answer: You need to use digital certificates.

Explanation:
Dayna, the consultant, shows Steve the scenario for using digital certificates; the other answers are related but not correctly.

Question 38

Which of the PKI components is responsible for issuing and verifying digital certificate?

A. Certificate authority (CA)
B. Registration authority (RA)
C. End user
D. Validation authority (VA)

Answer 38

Answer: Certificate authority (CA).

Explanation:
Validation authority (VA): Stores certificates (with their public keys)
Certificate authority (CA): Issues and verifies digital certificates
Registration authority (RA): Acts as the verifier for the certificate authority
End user: Requests, manages, and uses certificates

Question 39

Which of the following processes of PKI (public key infrastructure) ensures that a trust relationship exists and that a certificate is still valid for specific operations?

A. Certificate issuance
B. Certificate cryptography
C. Certificate validation
D. Certificate revocation

Answer 39

Answer: Certificate validation.

Explanation:
The certificate validation is a process of verifying the authenticity of a certificate. This is done by the validation authority (VA).

Question 40

Which of the following components of public key infrastructure stores certificates along with their public keys?

A. Certificate management system
B. Registration authority
C. Validation authority
D. Certificate authority

Answer 40

Answer: C. Validation authority

Explanation:
Components of PKI:

Certificate Management System: Generates, distributes, stores, and verifies certificates
Validation Authority (VA): Stores certificates (with their public keys)
Registration Authority (RA): Acts as the verifier for the CA
Certification Authority (CA): Issues and verifies digital certificates

Question 41

Which of the following protocols allows a client and server to authenticate each other, select an encryption algorithm, and exchange a symmetric key prior to data exchange?

A. TLS handshake protocol
B. TLS record protocol
C. GNU privacy guard
D. Pretty good privacy

Answer 41

Answer: TLS handshake protocol.

Explanation:
TLS Record Protocol: The TLS Record Protocol is a layered protocol. It provides secured connections with an encryption method such as DES. It secures application data using the keys generated during the handshake and verifies its integrity and origin.
TLS Handshake Protocol: It allows the client and server to authenticate each other, select an encryption algorithm, and exchange a symmetric key prior to data exchange.
Pretty Good Privacy: PGP is a protocol used to encrypt and decrypt data that provides authentication and cryptographic privacy. It is often used for data compression, digital signing, encryption and decryption of messages, emails, files, directories, and to enhance the privacy of email communications.
GNU Privacy Guard: GPG is a software replacement of PGP and free implementation of the OpenPGP standard. GPG is also called hybrid encryption software as it uses both symmetric key cryptography and asymmetric key cryptography.

Question 42

A person approaches a network administrator and wants advice on how to send encrypted e-mail from home. The end user does not want to have to pay for any license fees or manage server services. Which of the following is the most secure encryption protocol that the network administrator should recommend?

A. Pretty good privacy (PGP)
B. IP security (IPSEC)
C. Hypertext transfer protocol with secure socket layer (HTTPS)
D. Multipurpose Internet mail extensions (MIME)

Answer 42

Answer: Pretty good privacy (PGP).

Explanation:
PGP (pretty good privacy) is a protocol used to encrypt and decrypt data that provides authentication and cryptographic privacy. It is often used for data compression, digital signing, encryption and decryption of messages, e-mails, files, directories, and to enhance the privacy of e-mail communications. The algorithm used for message encryption is RSA. For key transport and IDEA for bulk-message encryption, PGP uses RSA for computing digital signatures and MD5 for computing message digests.
PGP combines the best features of both conventional (about 1,000 times faster than public-key encryption) and public-key cryptography (solution to key distribution and data transmission issues) and is therefore known as a hybrid cryptosystem. PGP is used for:
Encrypting a message or file prior to transmission so that only the recipient can decrypt and read it
Clear signing of the plaintext message to ensure the authenticity of the sender
Encrypting stored computer files so that no one other than the person who encrypted them can decrypt them
Deleting files, rather than just removing them from the directory or folder
Data compression for storage or transmission

Question 43

To send a PGP-encrypted message, which piece of information from the recipient must the sender have before encrypting the message?

A. Recipient’s private key
B. Master encryption key
C. Recipient’s public key
D. Sender’s public key

Answer 43

Answer: Recipient’s public key.

Explanation:
Working of PGP:
When a user encrypts data with PGP, PGP first compresses the data.
Compressing data reduces patterns in the plaintext that could be exploited by most of the cryptanalysis techniques to crack the cipher, thus prominently increasing resistance to cryptanalysis.
PGP then creates a random key (GSkAQk49fPD2h) that is a one-time-only secret key.
PGP uses the random key generated to encrypt the plaintext resulting in ciphertext.
Once data is encrypted, random key is encrypted with the recipient’s public key.
Public key-encrypted random key (Td7YuEkLg99Qd0) is sent along with the ciphertext to the recipient.

Question 44

Which of the following tools is used by a security professional to encrypt a disk partition to provide confidentiality to the sensitive information stored on it so that the chances of compromising the information are minimized?

A. FileVault
B. Vindicate
C. Nexpose
D. Akamai

Answer 44

Answer: FileVault.

Explanation:
Nexpose: Nexpose is a vulnerability scanner which aims to support the entire vulnerability management lifecycle, including discovery, detection, verification, risk classification, impact analysis, reporting and mitigation.
Vindicate: Vindicate is an LLMNR/NBNS/mDNS spoofing detection toolkit for network administrators. Security professionals use this tool to detect name service spoofing.
Akamai: Akamai provides DDoS protection for enterprises regularly targeted by DDoS attacks. Akamai Kona Site Defender delivers multi-layered defense that effectively protects websites and web applications against the increasing threat, sophistication, and scale of DDoS attacks.
FileVault: FileVault full-disk encryption (FileVault 2) uses XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to the information on your startup disk.

Question 45

Which of the following techniques is used for converting Outlook email messages so that senders and the designated receivers can access them without compromising the integrity of the message?

A. S/MIME encryption
B. Transform domain techniques
C. Disk encryption
D. Least-significant-bit insertion

Answer 45

Answer: S/MIME encryption.

Explanation:
Disk encryption: Disk encryption encrypts every bit of data stored on a disk or a disk volume, thus preventing illegal access to data storage.
Transform Domain Techniques: The transform domain technique hides the information in significant parts of the cover image, such as cropping, compression, and some other image processing areas.
Secure/Multipurpose Internet Mail Extensions (S/MIME) Encryption: S/MIME certification is a technique that allows users to encrypt their email messages. It is used for encrypting Outlook email messages so that senders and the designated receivers can access them without compromising the integrity of the message.
Least-Significant-Bit Insertion: The least-significant-bit insertion technique is the most commonly used technique of image steganography, in which the least significant bit (LSB) of each pixel helps hold secret data. The LSB is the rightmost bit of each pixel of an image.

Question 46

Given below are the various steps involved in encrypting email messages using S/MIME encryption. Identify the correct sequence of steps involved in encrypting messages using S/MIME.

1. Choose the Email Security option from the left pane.
2. In the Change Security Settings pop-up window, under the Certificates and Algorithms section, choose the S/MIME certificate for the Signing certificate and Encryption certificate options and click OK.
3. Select File à Options à Trust Center à Trust Center Settings.
4. In the Encrypted email section, click on the Settings option beside Default Setting.

Identify the correct sequence of steps involved in encrypting messages using S/MIME.

A. 3 -> 1 -> 4 -> 2
B. 2 -> 4 -> 3 -> 1
C. 3 -> 1 -> 2 -> 4
D. 4 -> 2 -> 1 -> 3

Answer 46

Answer: A. 3 -> 1 -> 4 -> 2

Explanation:
The steps to encrypt email messages using S/MIME encryption are discussed below.

Select File à Options à Trust Center à Trust Center Settings
Choose the Email Security option from the left pane
In the Encrypted email section, click on the Settings option beside Default Setting
In the Change Security Settings pop-up window, under the Certificates and Algorithms section, choose the S/MIME certificate for the Signing certificate and Encryption certificate options and click OK

Question 47

Given below are the different steps involved in encrypting a single email message using Office 365 Message Encryption (OME). Identify the correct sequence of steps involved in encrypting an email message using OME.

1.In the Security Properties pop-up window, check the Encrypt message contents and attachments option and click OK.
2. In an email message body, select the Options menu, go to Encrypt, and choose the encryption that includes the required constraints such as Encrypt-Only or Do Not Forward.
3. Click File and then Properties in the email message body.

4. In the Properties window, click on the Security Settings button in the Security section.

Identify the correct sequence of steps involved in encrypting an email message using OME.

A. 2 -> 3 -> 1 -> 4
B. 3 -> 1 -> 4 -> 2
C. 2 -> 4 -> 3 -> 1
D. 4 -> 2 -> 1 -> 3

Answer 47

Answer: C. 2 -> 4 -> 3 -> 1

Explanation:
The steps to encrypt email messages using OME encryption are as follows.

In an email message body, select the Options menu, go to Encrypt, and choose the encryption that includes the required constraints such as Encrypt-Only or Do Not Forward.
Click File and then Properties in the email message body.
In the Properties window, click on the Security Settings button in the Security section.
In the Security Properties pop-up window, check the Encrypt message contents and attachments option and click OK.

Question 48

Which of the following is end-to-end email encryption software configured with OpenPGP for securing emails and attachments in Google Mail?

A. FlowCrypt
B. Hashcat
C. Super network tunnel
D. Bitvise

Answer 48

Answer: FlowCrypt.

Explanation:
Super Network Tunnel: Super Network Tunnel is a two-way HTTP tunneling software that connects two computers using HTTP-Tunnel Client and HTTP-Tunnel Server.
Bitvise: Bitvise SSH Server provides secure remote login capabilities to Windows workstations and servers by encrypting data during transmission.
Hashcat: Hashcat is a cracker compatible with multiple OSs and platforms and can perform multihash (MD4, 5; SHA – 224, 256, 384, 512; RIPEMD-160; etc.), multi-device password cracking.
FlowCrypt: FlowCrypt is end-to-end email encryption software configured with OpenPGP for securing emails and attachments in Google mail (G Suite/Business/Enterprise). It allows the encryption/decryption of outgoing/incoming emails on user devices with private/public keys for accessing data.

Question 49

Which of the following is a Linux-based utility used to perform disk encryption based on the DMCrypt kernel module?

A. Vega
B. CORE Impact
C. Cryptsetup
D. Gobuster

Answer 49

Answer: Cryptsetup.

Explanation:
CORE Impact: CORE Impact finds vulnerabilities in an organization’s web server. This tool allows a user to evaluate the security posture of a web server by using the same techniques currently employed by cyber criminals.
Gobuster: Gobuster is a Go-programming-based directory scanner that allows attackers to perform fast-paced enumeration of hidden files and directories of a target web application.
Cryptsetup: Cryptsetup is a utility used to conveniently set up disk encryption based on the DMCrypt kernel module. It includes plain dm-crypt volumes, LUKS volumes, loop-AES, TrueCrypt (including the VeraCrypt extension), and BitLocker formats.
Vega: Vega is a free and open-source web security scanner and web security testing platform for testing the security of web applications.

Question 50

Identify the disk encryption tool that utilizes the XTS-AES-128 encryption technology along with a 256-bit key to prevent unauthorized access to the information on the startup disk.

A. SoapUI pro
B. Astra
C. FileVault 2
D. Veracode

Answer 50

Answer: FileVault 2.

Explanation:
SoapUI Pro: SoapUI Pro is a web service testing tool that supports multiple protocols such as SOAP, REST, HTTP, JMS, AMF, and JDBC.
Astra: Attackers use the Astra tool to detect and exploit underlying vulnerabilities in a REST API.
Veracode: Source code review is a security testing method that involves a systematic examination of the source code for various types of vulnerabilities. Automated tools such as Veracode can perform source code reviews.
FileVault2: FileVault full-disk encryption (FileVault 2) utilizes the XTS-AES-128 encryption technology along with a 256-bit key to prevent unauthorized access to the information on the startup disk. FileVault 2 is available for macOS Lion or higher versions.

Question 51

Given below are the various steps involved in encrypting all outgoing email messages using Office 365 Message Encryption (OME).

1. Choose the Email Security option from the left pane.
2. In the Encrypted email section, check the Encrypt contents and attachments for all outgoing messages option and click OK.
3. In an email message body, select the Options menu, go to Encrypt, and choose the encryption that includes the required constraints such as Encrypt-Only or Do Not Forward.
4. Select File à Options à Trust Center à Trust Center Settings.

Identify the correct sequence of steps involved in encrypting all outgoing email messages.

A. 3 -> 1 -> 2 -> 4
B. 2 -> 4 -> 3 -> 1
C. 4 -> 2 -> 1 -> 3
D. 3 -> 4 -> 1 -> 2

Answer 51

Answer: D. 3 -> 4 -> 1 -> 2

Question 52

Which of the following tools allows users to create hidden and encrypted partitions on a computer, a USB flash drive, or cloud storage services such as Google Drive, OneDrive, and Dropbox?

A. Rohos Disk Encryption
B. RMail
C. HashMyFiles
D. HashTools

Answer 52

Answer: Rohos Disk Encryption.

Explanation:
hash tools: hash tools is a utility for calculating and checking a hash from a given text or decrypting a hash to its original text. In this application, the available hash functions are MD5, SHA-1, SHA-256, SHA-384, and SHA-512.
Rohos Disk Encryption: Rohos is a disk encryption tool that allows users to create hidden and encrypted partitions on a computer, USB flash drive, or cloud storage service such as Google Drive, OneDrive, and Dropbox. The tool uses the NIST-approved AES encryption algorithm and an encryption key length of 256 bits, which enables automatic encryption.
HashMyFiles: HashMyFiles is a utility that allows you to calculate the MD5 and SHA1 hashes of one or more files in the system. It allows you to copy the MD5/SHA1 hash list to the clipboard or save it in a text/html/xml file. You can launch HashMyFiles from the context menu of Windows Explorer and display the MD5/SHA1 hashes of the selected files or folders.
RMail: RMail is an email security tool that provides open tracking, delivery proof, email encryption, electronic signatures, large file transfer functionality, etc.

Question 53

In one of the following attacks, an attacker has complete access to a plaintext message including its encryption, and they can modify the content of the message by making a series of interactive queries, choosing subsequent plaintext blocks based on the information from the previous encryption queries and functions. Which is this attack?

A. Ciphertext-only attack
B. Adaptive chosen-plaintext attack
C. Chosen-plaintext attack
D. Known-plaintext attack

Answer 53

Answer: B. Adaptive chosen-plaintext attack.

Explanation:
Ciphertext-only Attack: Ciphertext-only is less effective but much more likely for the attacker. The attacker only has access to a collection of ciphertexts. This is much more likely than known plaintext but is also the most difficult. The attack is completely successful if the corresponding plaintexts (or even better, the key) can be deduced.
Chosen-plaintext Attack: A chosen plaintext attack is a highly effective type of cryptanalysis attack. In this attack, the attacker obtains the ciphertexts corresponding to a set of plaintexts of his/her own choosing. This allows the attacker to attempt to derive the key used and thus decrypt other messages encrypted with that key.
Known-plaintext Attack: In this attack, the only information available to the attacker is some plaintext blocks along with the corresponding ciphertext and algorithm used to encrypt and decrypt the text. Using this information, the key used to generate the ciphertext is deduced so as to decipher other messages.
Adaptive Chosen-plaintext Attack: In this type of attack, an attacker has complete access to the plaintext message including its encryption, and he/she can also modify the content of the message by making a series of interactive queries, choosing subsequent plaintext blocks based on the information from the previous encryption queries and functions.

Question 54

Which of the following attacks exploits acoustic emissions from keyboards and computing components produced during computation to acquire useful information?

A. Side-channel attack
B. Birthday attack
C. Meet-in-the-middle attack
D. Brute-force attack

Answer 54

Answer: A. Side-channel attack.

Explanation:
Birthday Attack: A birthday attack refers to a class of brute-force attacks against cryptographic hashes that renders brute-forcing easier to performs. This attack depends on the birthday paradox, which is the probability of two or more people in a group of 23 sharing the same birthday is greater than 0.5.
Brute-Force Attack: Brute-force attack is a high-resource and time intensive process, but it is more guaranteed to achieve results. Attempting to decrypt a message using all possible keys until you discover the key used for encryption. This method of discovering a key is called a brute-force attack
Side-Channel Attack: A side-channel attack is a physical attack performed on a cryptographic device/cryptosystem to gain sensitive information. Cryptography is generally part of the hardware or software that runs on physical devices such as semi-conductors (resistor, transistor, and so on) that interact with and affect various environmental factors:
Sound: Acoustic attacks exploit the sound produced during a computation. These acoustic emissions are from keyboards and computing components (e.g., CPU, memory)

Meet-in-the-Middle Attack: A meet-in-the-middle attack is the best attack method for cryptographic algorithms using multiple keys for encryption. This attack reduces the number of brute-force permutations required to decode text encrypted by more than one key. A meet-in-the-middle attack uses space-time trade-off; it is also a type of birthday attack because it exploits the mathematics behind the birthday paradox, and the attack consumes less time than an exhaustive attack

Question 55

Which of the following cryptanalysis methods is also known as a plaintext attack, is based on finding affine approximations to the action of a cipher, and is commonly used on block ciphers?

A. Frequency analysis
B. Linear cryptanalysis
C. Differential cryptanalysis
D. Integral cryptanalysis

Answer 55

Answer: B. Linear cryptanalysis.

Explanation:
Differential Cryptanalysis: Differential cryptanalysis is a form of cryptanalysis applicable to symmetric-key algorithms. It was invented by Eli Biham and Adi Shamir. Essentially, it is the examination of differences in input and how that affects the resultant difference in the output. It originally worked only with chosen plaintext. It can also work with known plaintext and ciphertext
Linear Cryptanalysis: Linear cryptanalysis is based on finding affine approximations to the action of a cipher. It is commonly used on block ciphers. This technique was invented by Mitsarue Matsui. It is a known plaintext attack and uses a linear approximation to describe the behavior of the block cipher. Given sufficient pairs of plaintext and corresponding ciphertext, bits of information about the key can be obtained
Integral Cryptanalysis: Integral cryptanalysis was first described by Lars Knudsen. This attack is particularly useful against block ciphers based on substitution-permutation networks as an extension of differential cryptanalysis. The differential analysis looks at pairs of inputs that differ in only one bit position, with all other bits being identical.
Frequency Analysis: Frequency analysis is a code breaking methodology which isthe study of the frequency of letters or groups of letters in a ciphertext. Frequency analysis of letters and words is another method used to crack ciphers. It works on the principle that, in any given stretch of written language, certain letters and combinations of letters occur with varying frequencies

Question 56

Which of the following practices is NOT a countermeasure to mitigate side-channel attacks?

A. Mask and blind algorithms using random nonces
B. Avoid using fixed-time algorithms
C. Implement differential matching techniques to minimize net data-dependent leakage
D. Add amplitude or temporal noise to reduce the attacker’s signal-to-noise ratio

Answer 56

Answer: B. Avoid using fixed-time algorithms

Explanation:
Mitigation techniques for side-channel-attacks include the following:

Use differential power analysis (DPA) proof protocols with delimited side-channel leakage characteristics and update the keys before the leakage accumulation is significant
Use fixed-time algorithms (i.e., no data-dependent delays)
Mask and blind algorithms using random nonces
Implement differential matching techniques to minimize net data-dependent leakage from logic-level transitions
Pre-charge registers and busses to remove leakage signatures from predictable data transitions
Add amplitude or temporal noise to reduce the attacker’s signal-to-noise ratio

Question 57

In which of the following attacks does an attacker reduce the number of brute-force permutations required to decode text encrypted by more than one key and use the space-time trade-off?

A. Meet-in-the-middle attack
B. DUHK attack
C. Side-channel attack
D. Hash collision attack

Answer 57

Answer: A. Meet-in-the-middle attack.

Explanation:
DUHK Attack: Don’t Use Hard-Coded Keys (DUHK) is a cryptographic vulnerability that allows attackers to obtain encryption keys used to secure VPNs and web sessions. This attack mainly affects any hardware/software using the ANSI X9.31 Random Number Generator (RNG). Pseudorandom number generators (PRNGs) generate random sequences of bits based on the initial secret value, called seed, and the current state. The PRNG algorithm generates cryptographic keys that are used to establish a secure communication channel over the VPN.
Side-Channel Attack: A side-channel attack is a physical attack performed on a cryptographic device/cryptosystem to gain sensitive information. Cryptography is generally part of the hardware or software that runs on physical devices
Hash Collision Attack: A hash collision attack is performed by finding two different input messages that result in the same hash output. For example, in a hash collision attack, “hash(a1) = hash(a2)”, where a1 and a2 represent some random messages. Since the algorithm itself randomly selects these messages, attackers have no role in the content of these messages
Meet-in-the-Middle Attack: A meet-in-the-middle attack is the best attack method for cryptographic algorithms using multiple keys for encryption. This attack reduces the number of brute-force permutations required to decode text encrypted by more than one key. A meet-in-the-middle attack uses space-time trade-off; it is also a type of birthday attack because it exploits the mathematics behind the birthday paradox, and the attack consumes less time than an exhaustive attack. It is called a meet-in-the-middle attack because it works by encrypting from one end and decrypting from the other end, thereby meeting “in the middle.”

Question 58

An attacker has captured a target file that is encrypted with public key cryptography. Which of the attacks below is likely to be used to crack the target file?

A. Timing attack
B. Memory trade-off attack
C. Chosen plain-text attack
D. Replay attack

Answer 58

Answer: C. Chosen plain-text attack

Explanation:
Timing attack: It is based on repeatedly measuring the exact execution times of modular exponentiation operations. The attacker tries to break the ciphertext by analyzing the time taken to execute the encryption and decryption algorithm for various inputs. In a computer, the time taken to execute a logical operation may vary based on the input given. The attacker by giving varying inputs tries to extract the plaintext.
Replay attack: In a replay attack, packets and authentication tokens are captured using a sniffer. After the relevant info is extracted, the tokens are placed back on the network to gain access. The attacker uses this type of attack to replay bank transactions or other similar types of data transfer, in the hope of replicating and/or altering activities, such as banking deposits or transfers.
Chosen-plaintext attack: Chosen plaintext attack is a very effective type of cryptanalysis attack. In this attack, the attacker obtains the ciphertexts corresponding to a set of plaintexts of his own choosing. This can allow the attacker to attempt to derive the key used and thus decrypt other messages encrypted with that key. Basically, since the attacker knows the plaintext and the resultant ciphertext, he has a lot of insight into the key used. This technique can be difficult but is not impossible.
The circumstances by which an attacker may obtain ciphertexts for given plaintexts are rare. However, modern cryptography is implemented in software or hardware and is used for a diverse range of applications; for many cases, a chosen-plaintext attack is often very feasible. Chosen-plaintext attacks become extremely important in the context of public key cryptography, where the encryption key is public and so attackers can encrypt any plaintext they choose.

Question 59

An attacker tries to recover the plaintext of a message without knowing the required key in advance. For this he may first try to recover the key, or may go after the message itself by trying every possible combination of characters. Which code breaking method is he using?

A. Trickery and deceit
B. Brute force
C. Frequency analysis
D. One-time pad

Answer 59

Answer: B. Brute force.

Explanation:
The correct answer is (a). Brute force: This attack is a common cryptanalytic technique, or exhaustive search, in which the keys are determined by trying every possible combination of characters. The efficiency of a brute-force attack depends on the hardware configuration. The use of faster processors means testing more keys per second. Cryptanalysts carried out a successful brute-force attack on a DES encryption method that effectively made DES obsolete.

Question 60

Which of the following attacks mainly affects any hardware/software using an ANSI X9.31 random number generator (RNG)?

A. Hash collision attack
B. Side channel attack
C. Rainbow table attack
D. DUHK attack

Answer 60

Answer: D. DUHK attack.

Explanation:
The correct answer is (b). DUHK (don’t use hard-coded keys) is a cryptographic vulnerability that allows attackers to obtain encryption keys used to secure VPNs and web sessions. This attack mainly affects any hardware/software using ANSI X9.31 random number generator (RNG). The pseudorandom number generators (PRNGs) generate random sequences of bits based on the initial secret value called a seed and the current state. The PRNG algorithm generates cryptographic keys that are used to establish a secure communication channel over VPN network. In some cases, the seed key is hardcoded into the implementation. Both the factors are the key issues of DUHK attack as any attacker could combine ANSI X9.31 with the hard coded seed key to decrypt the encrypted data sent or received by that device.

Question 61

Out of the following, identify the attack that is used for cracking a cryptographic algorithm using multiple keys for encryption.

A. Side channel attack
B. Rainbow table attack
C. DUHK attack
D. Meet-in-the-middle attack

Answer 61

Answer: D. Meet-in-the-middle attack.

Explanation:
A meet-in-the-middle attack is the best attack method for cryptographic algorithms using multiple keys for encryption. This attack reduces the number of brute force permutations needed to decode text encrypted by more than one key and conducted mainly for forging signatures on mixed type digital signatures. A meet-in-the-middle attack uses space–time tradeoff; it is a birthday attack because it exploits the mathematics behind the birthday paradox. It is called a meet-in-the-middle attack because it works by encrypting from one end and decrypting from the other end, thus meeting “in the middle.”
In the meet-in-the-middle attack, the attacker uses a known plaintext message and has access to both the plaintext as well as the respective encrypted text. It takes less time than an exhaustive attack and is used by attackers for forging signatures, even on digital signatures that use the multiple-encryption scheme.

Question 62

Which of the following practices makes an organization’s data vulnerable to various cryptographic attacks?

A. Use redundant cryptosystems to encrypt data multiple times.
B. For certificate signing, the transfer of private keys should not be allowed.
C. Never impose a limit on the number of operations per key.
D. The output of the hash function should have a large bit length so that it is difficult to decrypt.

Answer 62

Answer: C. Never impose a limit on the number of operations per key.

Explanation:
The following countermeasures can be adopted to prevent cryptographic attacks:

Use redundant cryptosystems to encrypt data multiple times.
Impose a limit on the number of operations per key.
For certificate signing, the transfer of private keys should not be allowed.
The output of the hash function should have a larger bit length that makes it difficult to decrypt.
Only recommended tools or products should be used rather than self-engineered crypto algorithms or functions.

Question 63

Which of the following is a code-breaking methodology that involves the use of social engineering techniques to extract cryptography keys?

A. Trickery and deceit
B. One-time pad
C. Frequency analysis
D. Brute force

Answer 63

Answer: A. Trickery and deceit.

Explanation:
Brute Force: A common cryptanalytic technique is a brute-force attack, or exhaustive search, in which the keys are determined by trying every possible combination of characters.
Frequency analysis: Frequency analysis is the study of the frequency of letters or groups of letters in a ciphertext. Frequency analysis of letters and words is another method used to crack ciphers. It works on the principle that, in any given stretch of written language, certain letters and combinations of letters occur with varying frequencies.
Trickery and Deceit: Trickery and deceit require a high level of mathematical and cryptographic skills. It involves the use of social engineering techniques to extract cryptography keys.
One-Time Pad: One can crack any cipher if provided with sufficient time and resources. However, there is an exception called a one-time pad, which users assume to be unbreakable even with infinite resources. A one-time pad mostly contains a non-repeating set of letters or numbers, which the system chooses randomly. The user writes them on small sheets of paper and then pastes them together in a pad.

Question 64

In which of the following attacks does an attacker select a series of ciphertexts and then observe the resulting plaintext blocks?

A. Midnight attack
B. Ciphertext-only attack
C. Chosen-key attack
D. Adaptive chosen-ciphertext attack

Answer 64

Answer: D. Adaptive chosen-ciphertext attack.

Explanation:
Adaptive Chosen-ciphertext Attack: In this attack, the attacker selects a series of ciphertexts and then observes the resulting plaintext blocks.
Ciphertext-only Attack: Ciphertext-only is less effective but much more likely for the attacker. The attacker only has access to a collection of ciphertexts. The attack is completely successful if the corresponding plaintexts (or even better, the key) can be deduced.
Lunchtime or Midnight Attack: In this attack, the attacker can have access to the system for only a limited amount of time or can access only a few plaintext-ciphertext pairs.
Chosen-key Attack: In this type of attack, an attacker not only breaks a ciphertext but also breaks into a larger system, which is dependent of that ciphertext. The attacker usually breaks an n-bit key cipher into 2 n/2 operations. Once an attacker breaks the cipher, he gets access to the system, and he can control the whole system, access confidential data, and perform further attacks.

Question 65

Which of the following e-learning software allows comprehensive cryptographic experimentation on Linux, Mac OS X, and Windows and also allows users to develop and extend its platform in various ways with their own crypto plug-ins?

A. CrypTool 1 (CT1)
B. CrypTool-Online (CTO)
C. CrypTool 2 (CT2)
D. JCrypTool (JCT)

Answer 65

Answer: D. JCrypTool (JCT)

Explanation:
The CrypTool project develops e-learning programs in the area of cryptography and cryptanalysis. It consists of e-learning software (CT1, CT2, JCT, and CTO).

CrypTool 1 (CT1) – It is written in C++ and is a Windows program. It supports classical and modern cryptographic algorithms (encryption and decryption, key generation, secure passwords, authentication, secure protocols, etc.). It is used to perform cryptanalysis of several algorithms (Vigenère, RSA, AES, etc.)
CrypTool 2 (CT2) – It supports visual programming GUI and execution of cascades of cryptographic procedures. It runs under Windows.
JCrypTool (JCT) – It allows comprehensive cryptographic experimentation on Linux, MAC OS X, and Windows. It also allows users to develop and extend its platform in various ways with their own crypto plug-ins.
CrypTool-Online (CTO) – It runs in a browser and provides a variety of encryption methods and analysis tools.

Question 66

In one of the following techniques, attackers use two algorithms. They use Shor’s quantum factoring algorithm on public-key cryptographic algorithms such as RSA and ECDH to find the factors of large numbers in polynomial time. Further, they use Grover’s quantum search algorithm to make brute-force key search faster for block ciphers. Identify this technique.

A. Post-quantum cryptography
B. Quantum cryptanalysis
C. Quantum cryptography
D. Differential cryptanalysis

Answer 66

Answer: B. Quantum cryptanalysis.

Explanation:
Post-Quantum Cryptography: Post-quantum cryptography is also known as quantum-resistant and quantum-proof cryptography, as it is an advanced cryptographic algorithm (mostly public-key based) designed to protect security systems from attacks initiated on both conventional and quantum computers.
Quantum Cryptography: In quantum cryptography, the data are encrypted by a sequence of photons that have a spinning trait while traveling from one end to another end.
Quantum Cryptanalysis: Quantum cryptanalysis is the process of cracking cryptographic algorithms using a quantum computer. Attackers can use Shor’s quantum factoring algorithm on public-key cryptographic algorithms such as RSA and Elliptic Curve Diffie-Hellman (ECDH) to find the factors of large numbers in polynomial time and Grover’s quantum search algorithm to make brute-force key search faster for block ciphers (AES) or hash functions (SHA).
Differential Cryptanalysis: Differential cryptanalysis is a form of cryptanalysis applicable to symmetric-key algorithms. It was invented by Eli Biham and Adi Shamir. Essentially, it is the examination of differences in input and how that affects the resultant difference in the output. It originally worked only with chosen plaintext. It can also work with known plaintext and ciphertext.

Question 67

Which of the following practices helps security professionals protect an organization’s data from various cryptographic attacks?

A. Passphrases and passwords must not be used to encrypt the key, if stored on the disk.
B. Keys should be present inside the source code or binaries.
C. Access to cryptographic keys should not be given directly to an application or a user.
D. Enforce hardware-backed security such as hardware security modules (HSMs) to enhance the cryptographic key security.

Answer 67

Answer: D. Enforce hardware-backed security such as hardware security modules (HSMs) to enhance the cryptographic key security.

Explanation:
The following countermeasures can be adopted to prevent cryptographic attacks:

Access of cryptographic keys should be given directly to the application or user.
Enforce hardware-backed security such as hardware security modules (HSMs) to enhance the cryptographic key security.
IDS should be deployed to monitor exchanging and access of keys.
Passphrases and passwords must be used to encrypt the key, if stored in the disk.
Keys should not be present inside the source code or binaries.

Question 68

Which of the following cryptography attack methods is usually performed without the use of a computer?

A. Ciphertext-only attack
B. Chosen key attack
C. Rainbow table attack
D. Rubber hose attack

Answer 68

Answer: D. Rubber hose attack.

Explanation:
The correct answer is (c). In a rubber hose attack, attackers extract cryptographic secrets (e.g. the password to an encrypted file) from a person by coercion or torture. Generally, people under pressure cannot maintain security, and they reveal secret or hidden information. Attackers torture the concerned person to reveal secret keys or passwords used to encrypt the information.

Question 69

In which of the following attacks, can an attacker obtain ciphertexts encrypted under two different keys and gather plaintext and matching ciphertext?

A. Related-key attack
B. Adaptive chosen-plaintext attack
C. Ciphertext-only attack
D. Chosen-plaintext attack

Answer 69

Answer: A. Related-key attack.

Explanation:
The correct answer is (c). Related-key attack: The related-key attack is similar to the chosen plaintext attack, except that the attacker can obtain ciphertexts encrypted under two different keys. This is actually a very useful attack if one can obtain the plaintext and matching ciphertext. The attack requires that the differing keys be closely related, for example, in a wireless environment where subsequent keys might be derived from previous keys. Then, while the keys are different, they are close. Much like the ciphertext-only attack, this one is most likely to yield a partial break.

Question 70

An attacker breaks an n bit key cipher into 2 n/2 number of operations in order to recover the key. Which cryptography attack is he performing?

A. Timing attack
B. Chosen-key attack
C. Known-plaintext attack
D. Rubber hose attack

Answer 70

Answer: B. Chosen-key attack

Explanation:
The attacker obtains the plaintexts corresponding to an arbitrary set of ciphertexts of his own choice. Using this information, the attacker tries to recover the key used to encrypt the plaintext. To perform this attack, the attacker must have access to the communication channel between the sender and the receiver.

Question 71

Out of the following attacks, which attack is a physical attack that is performed on a cryptographic device/cryptosystem to gain sensitive information?

A. DUHK attack
B. Side channel attack
C. Hash collision attack
D. MITM attack

Answer 71

Answer: B. Side channel attack.

Explanation:
The correct answer is (a). In a side channel attack, an attacker monitors channels (environmental factors) and tries to acquire the information useful for cryptanalysis. The information collected in this process is termed as side channel information. Side channel attacks do not relate with traditional/ theoretical form of attacks like brute force attack. The concept of the side channel attack depends on the way systems implement cryptographic algorithms, rather than the algorithm itself.

Question 72

Which of the following cryptanalysis methods is applicable to symmetric key algorithms?

A. Linear cryptanalysis
B. Integral cryptanalysis
C. Frequency cryptanalysis
D. Differential cryptanalysis

Answer 72

Answer: D. Differential cryptanalysis