SDL Cryptography & Data Protection

Question 1

Which cryptographic algorithm is considered most suitable for encrypting data at rest according to SDL best practices?

Accepted Answer

AES-256 in CBC or GCM mode

Answer

DES with a 56-bit key

Answer

RC4 with a 128-bit key

Answer

3DES with two independent keys

Question 2

In SDL, what is the primary purpose of using a Hash-based Message Authentication Code (HMAC)?

Accepted Answer

To verify both integrity and authenticity of a message

Answer

To encrypt data in transit

Answer

To generate public/private key pairs

Answer

To compress data before storage

Question 3

Which key exchange protocol is commonly recommended in SDL to establish a shared secret over an insecure channel without transmitting the secret itself?

Accepted Answer

Diffie-Hellman (or ECDH) key agreement

Answer

RSA key transport

Answer

Pre-shared key distribution

Answer

Kerberos ticket exchange

Question 4

What is the recommended minimum RSA key length for new SDL-compliant applications as of current NIST guidance?

Accepted Answer

2048 bits

Answer

512 bits

Answer

1024 bits

Answer

4096 bits is the only acceptable size

Question 5

In an SDL context, what does 'salting' a password hash primarily protect against?

Accepted Answer

Rainbow table and precomputation attacks

Answer

Brute-force attacks on individual accounts

Answer

SQL injection attacks

Answer

Man-in-the-middle interception of passwords

Question 6

Which TLS version should SDL-compliant systems deprecate support for to avoid known vulnerabilities?

Accepted Answer

TLS 1.0 and TLS 1.1

Answer

TLS 1.3

Answer

TLS 1.2 with approved cipher suites

Answer

TLS 1.2 with AEAD ciphers

Question 7

What is the main security advantage of Authenticated Encryption with Associated Data (AEAD) ciphers like AES-GCM over AES-CBC?

Accepted Answer

AEAD provides both confidentiality and integrity in a single operation

Answer

AEAD ciphers are faster on all hardware platforms

Answer

AEAD uses longer keys than CBC mode

Answer

AEAD eliminates the need for initialization vectors