SE Cryptography and PKI 2

Question 1

Which hashing algorithm is currently recommended by NIST for secure applications due to its collision resistance?

Accepted Answer

SHA-256 (SHA-2 family)

Answer

SHA-256 is part of the NIST-recommended SHA-2 family, offering strong collision resistance for security applications.

Question 2

What does Perfect Forward Secrecy (PFS) ensure in a TLS session?

Accepted Answer

Past session keys cannot be compromised even if the server's long-term private key is later exposed

Answer

PFS uses ephemeral key exchange (e.g., ECDHE) so each session uses a unique key, protecting past sessions if the private key is compromised.

Question 3

Which protocol provides online certificate status checking as a faster alternative to CRLs?

Accepted Answer

OCSP

Answer

OCSP (Online Certificate Status Protocol) allows clients to query a CA in real time for the revocation status of a specific certificate.

Question 4

A security engineer discovers that the same nonce was used twice with AES-GCM. What is the impact?

Accepted Answer

Confidentiality and integrity are both broken for those sessions

Answer

Nonce reuse with AES-GCM allows an attacker to recover plaintext and forge authentication tags, breaking both confidentiality and integrity.

Question 5

What is key escrow in the context of cryptography?

Accepted Answer

Storing a copy of encryption keys with a trusted third party for authorized recovery

Answer

Key escrow deposits copies of cryptographic keys with a trusted third party so authorized parties (e.g., law enforcement, IT) can recover encrypted data.

SE - Security Engineer Practice Test

SE - Security Engineer Practice Test

SE Cryptography and PKI 2