SDL Cryptography & Data Protection 2

Question 1

In SDL, what is 'key rotation' and why is it required for long-lived encryption keys?

Accepted Answer

Replacing cryptographic keys at defined intervals to limit exposure from a compromised key

Answer

Changing the encryption algorithm periodically to stay current

Answer

Distributing keys to multiple servers for redundancy

Answer

Converting keys between different formats for compatibility

Question 2

Which of the following is an asymmetric encryption algorithm approved for use in SDL-compliant systems?

Accepted Answer

Elliptic Curve Cryptography (ECC) with P-256 or higher

Answer

AES-256

Answer

ChaCha20

Answer

HMAC-SHA-256

Question 3

What SDL practice is used to ensure that sensitive data (e.g., credit card numbers) is replaced with a non-sensitive placeholder while preserving format?

Accepted Answer

Tokenization

Answer

Encryption

Answer

Hashing

Answer

Data masking at the presentation layer

Question 4

Under SDL, which practice BEST prevents cryptographic keys from being exposed in source code repositories?

Accepted Answer

Storing keys in environment variables or a dedicated secrets management system

Answer

Encoding keys in Base64 before committing

Answer

Compressing key files before commit

Answer

Renaming key files to avoid detection by scanners

Question 5

What is the cryptographic weakness that makes MD5 unsuitable for SDL-compliant password hashing?

Accepted Answer

MD5 is vulnerable to collision attacks and is too fast for brute-force resistance

Answer

MD5 produces hashes that are too short to store

Answer

MD5 is computationally expensive, making login slow

Answer

MD5 can only hash ASCII characters

Question 6

In SDL data classification, which category of data typically requires the strongest encryption and strictest key management controls?

Accepted Answer

Regulated data such as PII, PHI, or financial records

Answer

Publicly available marketing data

Answer

Internal employee directory information

Answer

System performance metrics and logs

Question 7

Which SDL principle ensures that even if a single cryptographic control fails, other independent controls still protect sensitive data?

Accepted Answer

Defense in depth (layered security)

Answer

Single point of failure elimination

Answer

Least privilege

Answer

Separation of duties