CSX Cryptography and Data Protection Flashcards

What is the difference between data in transit and data at rest, and which requires TLS as a protection?

Answer: Data in transit requires TLS; data at rest uses encryption like AES-256

TLS protects data in transit (moving across networks), while data at rest is protected using storage encryption like AES-256.

What is certificate pinning and why is it used in mobile applications?

Answer: It hardcodes expected certificate or public key values to prevent MitM attacks

Certificate pinning embeds the expected certificate or public key hash in the app, rejecting connections using unexpected certificates.

Which of the following best describes a cryptographic nonce?

Answer: A one-time random value used to prevent replay attacks in cryptographic protocols

A nonce is a randomly generated value used once in a cryptographic operation to ensure uniqueness and prevent replay attacks.

Under NIST guidelines, what is the recommended minimum key length for RSA encryption to provide adequate security today?

Answer: 2048 bits

NIST recommends a minimum of 2048-bit RSA keys for current use, with 3072 or 4096 bits for long-term security.

What is the primary goal of tokenization in payment card security (PCI DSS)?

Answer: To replace sensitive card data with a non-sensitive token, reducing PCI scope

Tokenization replaces primary account numbers (PANs) with tokens that have no exploitable value, reducing systems in PCI DSS scope.

Which cryptographic concept ensures that even if one session key is compromised, past session keys remain secure?

Answer: Perfect Forward Secrecy (PFS)

Perfect Forward Secrecy generates ephemeral session keys so that compromise of a long-term key does not expose past communications.