CREST Cryptography & PKI 3

Question 1

What is a rainbow table attack used for?

Accepted Answer

Cracking password hashes using precomputed hash chains

Answer

Rainbow tables are precomputed lookup tables of hash values that allow rapid recovery of plaintext passwords from stolen hashes.

Question 2

Which countermeasure is most effective against rainbow table attacks?

Accepted Answer

Using a unique random salt per password before hashing

Answer

Adding a unique random salt to each password before hashing ensures that identical passwords produce different hash values, rendering precomputed rainbow tables useless.

Question 3

What is the Diffie-Hellman key exchange used for?

Accepted Answer

Establishing a shared secret over an insecure channel without transmitting it

Answer

Diffie-Hellman allows two parties to derive a shared secret by exchanging public values over an untrusted channel, without ever transmitting the secret itself.

Question 4

Which of the following is a known weakness of the MD5 hashing algorithm?

Accepted Answer

It is vulnerable to collision attacks

Answer

MD5 is cryptographically broken due to practical collision attacks that allow two different inputs to produce the same MD5 hash.

Question 5

What does certificate pinning protect against?

Accepted Answer

Fraudulent certificates issued by rogue or compromised CAs

Answer

Certificate pinning ties an application to a specific certificate or public key, preventing trust in valid-but-fraudulent certificates from other CAs.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Cryptography & PKI 3