CASP+ Cryptography and PKI 3

Question 1

An organization is deploying code signing for its software releases. Which control MOST effectively prevents tampering with signed binaries after release?

Accepted Answer

Detached signatures stored separately from the binary

Answer

Detached signatures are stored separately so recipients can verify the binary independently, and any modification to the binary invalidates the signature.

Question 2

Which key management practice MOST reduces the risk of key compromise over time?

Accepted Answer

Implementing automated key rotation with defined cryptoperiods

Answer

Defined cryptoperiods with automated rotation limit the exposure window if a key is compromised and reduce the data volume encrypted under any single key.

Question 3

A certificate authority issues a wildcard certificate for *.example.com. Which domain is NOT covered by this certificate?

Accepted Answer

sub.mail.example.com

Answer

Wildcard certificates cover exactly one level of subdomain; sub.mail.example.com has two subdomain levels below example.com and is not covered by *.example.com.

Question 4

Which cryptographic primitive is used to derive multiple keys from a single shared secret in TLS?

Accepted Answer

HMAC-based Key Derivation Function (HKDF)

Answer

HKDF uses HMAC to extract entropy from the shared secret and then expand it into keying material for multiple purposes (encryption, MAC, IV) within the TLS session.

Question 5

Which attack exploits predictable initialization vectors (IVs) in CBC mode encryption?

Accepted Answer

BEAST (Browser Exploit Against SSL/TLS)

Answer

BEAST exploited predictable IVs in TLS 1.0 CBC mode, allowing an attacker to perform a chosen-plaintext attack and decrypt session data.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Cryptography and PKI 3