SDL Cryptography & Data Protection 3

Question 1

What is the role of a Certificate Authority (CA) in SDL's use of Public Key Infrastructure (PKI)?

Accepted Answer

To issue, sign, and revoke digital certificates that bind public keys to identities

Answer

To generate symmetric session keys for TLS

Answer

To store private keys on behalf of users

Answer

To encrypt data before it is transmitted over TLS

Question 2

In SDL, which password hashing algorithm is preferred over bcrypt for resistance to GPU-based and memory-constrained hardware attacks?

Accepted Answer

Argon2id

Answer

SHA-512

Answer

PBKDF2 with 1 iteration

Answer

MD5 with a salt

Question 3

What SDL mechanism is used to detect whether encrypted data has been tampered with before decryption occurs?

Accepted Answer

Authenticated tag verification in AEAD modes

Answer

Initialization Vector (IV) validation

Answer

Key length checking

Answer

Certificate pinning

Question 4

Which SDL practice is designed to ensure that decrypted data is not held in memory longer than necessary?

Accepted Answer

Secure memory zeroing / wiping after use

Answer

Memory encryption at rest

Answer

Encrypting heap memory segments

Answer

Using read-only memory pages for sensitive data

Question 5

What does 'perfect forward secrecy' (PFS) provide in an SDL-compliant TLS configuration?

Accepted Answer

Guarantees that past session keys cannot be derived even if the server's long-term private key is later compromised

Answer

Ensures that all cipher suites use the same key for every session

Answer

Allows clients to reuse session tickets indefinitely

Answer

Prevents downgrade attacks by refusing older protocol versions

Question 6

In SDL, what is the purpose of 'envelope encryption' in a cloud key management system?

Accepted Answer

Encrypting data with a data encryption key (DEK) and then encrypting the DEK with a key encryption key (KEK)

Answer

Using a physical hardware token to store the master key

Answer

Sending encrypted data inside a digitally signed envelope

Answer

Wrapping a private key in a password-protected PEM container

Question 7

According to SDL guidelines, which practice should be applied when generating cryptographic nonces or IVs to prevent predictability attacks?

Accepted Answer

Use a cryptographically secure pseudo-random number generator (CSPRNG)

Answer

Derive IVs deterministically from the message content for reproducibility

Answer

Reuse the same IV across sessions to reduce key management overhead

Answer

Generate IVs from the system clock timestamp