CASP+ Cryptography and PKI 2

Question 1

A developer is choosing between hashing algorithms for password storage. Which option is MOST appropriate?

Accepted Answer

bcrypt with an appropriate work factor

Answer

bcrypt is a password-hashing function designed to be computationally expensive and includes built-in salting, making brute-force attacks impractical.

Question 2

Which attack targets the mathematical relationship between a public and private RSA key pair when small prime factors are used?

Accepted Answer

Factoring attack (e.g., using Pollard's rho or GNFS)

Answer

RSA security relies on the difficulty of factoring the modulus n = p×q; weak primes allow efficient factoring algorithms to recover the private key.

Question 3

An organization must encrypt data at rest in a cloud environment while retaining sole control of the encryption keys. Which model achieves this?

Accepted Answer

Customer-managed keys (CMK) stored in a customer-controlled HSM (HYOK — Hold Your Own Key)

Answer

HYOK/CMK with a customer-controlled HSM ensures the cloud provider never has access to the plaintext keys, giving the customer sole cryptographic control.

Question 4

Which property of a cryptographic hash function ensures that two different inputs cannot produce the same hash output?

Accepted Answer

Collision resistance

Answer

Collision resistance means it is computationally infeasible to find any two distinct inputs x and y such that H(x) = H(y).

Question 5

A TLS 1.3 handshake eliminates which legacy feature compared to TLS 1.2?

Accepted Answer

RSA key exchange (non-forward-secret)

Answer

TLS 1.3 removes RSA key exchange entirely, mandating ephemeral key exchange (ECDHE/DHE) to ensure perfect forward secrecy for all sessions.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Cryptography and PKI 2