CISSP Cryptography 2 — Questions and Answers
Question 1: Which key exchange protocol allows two parties to establish a shared secret over an insecure channel without transmitting the secret itself?
- RSA key exchange
- Diffie-Hellman (Correct answer)
- El Gamal
- ECDSA
Correct answer: Diffie-Hellman
Diffie-Hellman enables two parties to derive a shared secret using public values without ever transmitting the secret itself.
Question 2: A digital signature provides which two security services?
- Confidentiality and availability
- Authentication and non-repudiation (Correct answer)
- Integrity and confidentiality
- Authorization and accountability
Correct answer: Authentication and non-repudiation
Digital signatures verify the signer's identity (authentication) and prevent the signer from denying the action (non-repudiation).
Question 3: What is the primary weakness of a one-time pad if the same pad is used more than once?
- It becomes vulnerable to brute-force attacks
- XORing two ciphertexts reveals information about plaintexts (Correct answer)
- The key length becomes shorter than the message
- It loses its public-key properties
Correct answer: XORing two ciphertexts reveals information about plaintexts
Reusing a one-time pad allows an attacker to XOR two ciphertexts together, canceling the key and exposing a combination of the two plaintexts.
Question 4: Which mode of operation for block ciphers produces the same ciphertext for identical plaintext blocks and is considered insecure for most uses?
- CBC
- CTR
- ECB (Correct answer)
- GCM
Correct answer: ECB
Electronic Codebook (ECB) mode encrypts each block independently, so identical plaintext blocks produce identical ciphertext blocks, leaking data patterns.
Question 5: In PKI, what is the purpose of a Certificate Revocation List (CRL)?
- To list certificates that will expire soon
- To publish certificates awaiting validation
- To enumerate certificates that have been invalidated before their expiry (Correct answer)
- To store private keys of revoked users
Correct answer: To enumerate certificates that have been invalidated before their expiry
A CRL is a signed list published by the CA that identifies certificates that have been revoked and should no longer be trusted.
Question 6: What cryptographic property ensures that a small change in input produces a drastically different output hash?
- Confusion
- Diffusion
- Avalanche effect (Correct answer)
- Collision resistance
Correct answer: Avalanche effect
The avalanche effect means flipping even a single bit in the input causes approximately half the output bits to change.
Question 7: Which of the following best describes a birthday attack against a hash function?
- Brute-forcing a hash until the original input is found
- Finding two different inputs that produce the same hash value (Correct answer)
- Cracking a hash using the victim's birthdate as the key
- Intercepting a hash during transmission on the victim's birthday
Correct answer: Finding two different inputs that produce the same hash value
A birthday attack exploits the birthday paradox to find two different messages with the same hash (a collision) far faster than brute force.
CISSP Cryptography 2
Which key exchange protocol allows two parties to establish a shared secret over an insecure channel without transmitting the secret itself?