SDL Cryptography & Data Protection 3

Question 1

What is the role of a Certificate Authority (CA) in SDL's use of Public Key Infrastructure (PKI)?

Accepted Answer

To issue, sign, and revoke digital certificates that bind public keys to identities

Answer

A CA is a trusted third party that issues and digitally signs certificates, establishing the binding between a public key and the entity's identity.

Question 2

In SDL, which password hashing algorithm is preferred over bcrypt for resistance to GPU-based and memory-constrained hardware attacks?

Accepted Answer

Argon2id

Answer

Argon2id (the winner of the Password Hashing Competition) is memory-hard, making it resistant to GPU and ASIC attacks; it is the current SDL recommendation.

Question 3

What SDL mechanism is used to detect whether encrypted data has been tampered with before decryption occurs?

Accepted Answer

Authenticated tag verification in AEAD modes

Answer

AEAD modes produce an authentication tag; if the ciphertext or associated data has been tampered with, tag verification fails before any decryption takes place.

Question 4

Which SDL practice is designed to ensure that decrypted data is not held in memory longer than necessary?

Accepted Answer

Secure memory zeroing / wiping after use

Answer

SDL requires that sensitive plaintext be zeroed out (overwritten) in memory immediately after use to minimize the window during which it could be read by an attacker.

Question 5

What does 'perfect forward secrecy' (PFS) provide in an SDL-compliant TLS configuration?

Accepted Answer

Guarantees that past session keys cannot be derived even if the server's long-term private key is later compromised

Answer

PFS uses ephemeral key exchange (ECDHE/DHE) so that each session's key is independent; compromise of the server's long-term key does not expose past session traffic.

(SDL) Security Development Lifecycle Certification Practice Test

(SDL) Security Development Lifecycle Certification Practice Test

SDL Cryptography & Data Protection 3