CyberVista Cryptography and PKI Questions and Answers — Questions and Answers
Question 1: A security analyst needs to implement an encryption method that is fast, efficient for large amounts of data, and uses a single key for both encryption and decryption. Which type of cryptography best meets these requirements?
- Symmetric encryption (Correct answer)
- Asymmetric encryption
- Hashing
- Quantum cryptography
Correct answer: Symmetric encryption
Symmetric encryption uses a single shared key to both encrypt and decrypt data. It is known for its speed and efficiency, making it ideal for encrypting large volumes of data, such as in database or file encryption.
Question 2: In a Public Key Infrastructure (PKI), what is the primary role of a Certificate Authority (CA)?
- To encrypt and decrypt user data.
- To generate and securely store users' private keys.
- To verify the identity of entities and issue digital certificates. (Correct answer)
- To create and maintain the Certificate Revocation List (CRL) exclusively.
Correct answer: To verify the identity of entities and issue digital certificates.
The fundamental role of a Certificate Authority (CA) is to act as a trusted third party that validates the identity of entities (like websites, organizations, or individuals) and binds that identity to a public key by issuing a signed digital certificate.
Question 3: A software developer wants to ensure that the source code of an application has not been altered since it was created and to provide proof of its origin. Which cryptographic control should be used to achieve both data integrity and non-repudiation?
- A digital signature (Correct answer)
- A symmetric key
- A message digest
- A digital certificate
Correct answer: A digital signature
A digital signature, created by hashing the data and then encrypting the hash with the sender's private key, provides both integrity (ensuring the data hasn't changed) and non-repudiation (proving the sender's identity, as only they could have used the private key).
Question 4: Which of the following hashing algorithms is now considered insecure and vulnerable to collision attacks, making it unsuitable for modern security applications like password storage?
- SHA-256
- SHA-3
- MD5 (Correct answer)
- Bcrypt
Correct answer: MD5
MD5 is an older hashing algorithm that has been found to have significant vulnerabilities, most notably its susceptibility to collision attacks, where two different inputs can produce the same hash value. Due to this weakness, it is considered insecure for modern cryptographic purposes.
Question 5: A company is setting up an internal network and needs to issue certificates for its internal servers and devices. The company wants full control over the certificate issuance process and does not require public trust. Which PKI component should they implement?
- A Public Certificate Authority
- A Registration Authority
- A Private Certificate Authority (Correct answer)
- A Validation Authority
Correct answer: A Private Certificate Authority
A Private Certificate Authority (or internal CA) is set up and managed by an organization for its own internal use. This allows the organization to issue and manage certificates for internal servers, devices, and users without needing validation from a public CA, providing complete control over the trust hierarchy.
Question 6: What is the fundamental difference between a digital signature and a digital certificate?
- A digital signature encrypts data, while a digital certificate hashes it.
- A digital signature uses symmetric keys, while a digital certificate uses asymmetric keys.
- A digital certificate is used to prove ownership of a public key, while a digital signature is used to verify the integrity and authenticity of data. (Correct answer)
- A digital certificate is created by the user, while a digital signature is issued by a Certificate Authority.
Correct answer: A digital certificate is used to prove ownership of a public key, while a digital signature is used to verify the integrity and authenticity of data.
A digital certificate is an electronic document issued by a CA that binds an identity to a public key, proving who owns it. A digital signature is a cryptographic mechanism used to verify the authenticity (proof of sender) and integrity (proof the data wasn't altered) of a message or document.
