CASP+ Cryptography and PKI 2 — Questions and Answers
Question 1: A developer is choosing between hashing algorithms for password storage. Which option is MOST appropriate?
- MD5 with a random salt
- SHA-256 with no salt
- bcrypt with an appropriate work factor (Correct answer)
- SHA-3 without stretching
Correct answer: bcrypt with an appropriate work factor
bcrypt is a password-hashing function designed to be computationally expensive and includes built-in salting, making brute-force attacks impractical.
Question 2: Which attack targets the mathematical relationship between a public and private RSA key pair when small prime factors are used?
- Birthday attack
- Padding oracle attack
- Factoring attack (e.g., using Pollard's rho or GNFS) (Correct answer)
- Timing side-channel attack
Correct answer: Factoring attack (e.g., using Pollard's rho or GNFS)
RSA security relies on the difficulty of factoring the modulus n = p×q; weak primes allow efficient factoring algorithms to recover the private key.
Question 3: An organization must encrypt data at rest in a cloud environment while retaining sole control of the encryption keys. Which model achieves this?
- Cloud provider-managed encryption (SSE with provider keys)
- Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key) (Correct answer)
- Server-side encryption with provider-generated keys
- Client-side encryption with keys derived from passwords stored in the cloud
Correct answer: Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key)
HYOK/CMK with a customer-controlled HSM ensures the cloud provider never has access to the plaintext keys, giving the customer sole cryptographic control.
Question 4: Which property of a cryptographic hash function ensures that two different inputs cannot produce the same hash output?
- Preimage resistance
- Second preimage resistance
- Collision resistance (Correct answer)
- One-way property
Correct answer: Collision resistance
Collision resistance means it is computationally infeasible to find any two distinct inputs x and y such that H(x) = H(y).
Question 5: A TLS 1.3 handshake eliminates which legacy feature compared to TLS 1.2?
- Certificate-based authentication
- The use of asymmetric cryptography
- RSA key exchange (non-forward-secret) (Correct answer)
- Digital signatures on the handshake
Correct answer: RSA key exchange (non-forward-secret)
TLS 1.3 removes RSA key exchange entirely, mandating ephemeral key exchange (ECDHE/DHE) to ensure perfect forward secrecy for all sessions.
Question 6: Which technique allows computation on encrypted data without decrypting it?
- Symmetric encryption with a shared key
- Homomorphic encryption (Correct answer)
- Envelope encryption
- Tokenization
Correct answer: Homomorphic encryption
Homomorphic encryption allows mathematical operations to be performed on ciphertext, producing an encrypted result that decrypts to the same value as operating on the plaintext.
