SDL Cryptography & Data Protection 2

Question 1

In SDL, what is 'key rotation' and why is it required for long-lived encryption keys?

Accepted Answer

Replacing cryptographic keys at defined intervals to limit exposure from a compromised key

Answer

Key rotation limits the amount of data encrypted under any single key and reduces the damage if a key is compromised, which is a core SDL data protection requirement.

Question 2

Which of the following is an asymmetric encryption algorithm approved for use in SDL-compliant systems?

Accepted Answer

Elliptic Curve Cryptography (ECC) with P-256 or higher

Answer

ECC with curves such as P-256 (NIST) is an approved asymmetric algorithm; AES and ChaCha20 are symmetric, and HMAC is a MAC scheme.

Question 3

What SDL practice is used to ensure that sensitive data (e.g., credit card numbers) is replaced with a non-sensitive placeholder while preserving format?

Accepted Answer

Tokenization

Answer

Tokenization replaces sensitive data with a surrogate value (token) that maps back to the original only in a secure vault, reducing PCI-DSS scope.

Question 4

Under SDL, which practice BEST prevents cryptographic keys from being exposed in source code repositories?

Accepted Answer

Storing keys in environment variables or a dedicated secrets management system

Answer

Storing keys in environment variables or dedicated secrets managers (e.g., Azure Key Vault, HashiCorp Vault) keeps them out of version control entirely.

Question 5

What is the cryptographic weakness that makes MD5 unsuitable for SDL-compliant password hashing?

Accepted Answer

MD5 is vulnerable to collision attacks and is too fast for brute-force resistance

Answer

MD5 has known collision vulnerabilities and its speed makes it trivial to brute-force; SDL requires slow adaptive algorithms like bcrypt or Argon2 for passwords.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Cryptography & Data Protection 2