SSCA Cryptography & PKI 3

Question 1

What is the purpose of a Hardware Security Module (HSM) in a cryptographic infrastructure?

Accepted Answer

To securely generate, store, and manage cryptographic keys in tamper-resistant hardware

Answer

An HSM is a dedicated physical device that protects cryptographic key material and performs cryptographic operations in a tamper-resistant environment, preventing key extraction.

Question 2

Which concept describes the practice of keeping a copy of an encryption key with a trusted third party so it can be recovered if lost?

Accepted Answer

Key escrow

Answer

Key escrow involves depositing a copy of a cryptographic key with a trusted third party (often a government authority or enterprise agent) for lawful recovery purposes.

Question 3

During a TLS 1.3 handshake, which step establishes the shared session key?

Accepted Answer

Both parties use an ephemeral Diffie-Hellman exchange to derive a shared secret

Answer

TLS 1.3 mandates ephemeral Diffie-Hellman (ECDHE) for key establishment, providing forward secrecy and removing older RSA key exchange methods.

Question 4

What does a Message Authentication Code (MAC) provide that a simple hash function does not?

Accepted Answer

Both integrity and data origin authentication using a shared secret key

Answer

A MAC uses a shared secret key in addition to the message content, ensuring that only parties with the key can generate or verify the code, adding authentication to integrity.

Question 5

Which cipher suite component provides forward secrecy by ensuring that past session keys cannot be recovered even if the server's long-term private key is compromised?

Accepted Answer

Ephemeral ECDHE key exchange

Answer

Ephemeral ECDHE generates a new key pair for each session; since session keys are never derived from the long-term private key, their compromise does not expose past sessions.

SSCA - Systems Security Certified Administrator Practice Test

SSCA - Systems Security Certified Administrator Practice Test

SSCA Cryptography & PKI 3