SSCP Cryptography & PKI 3 — Questions and Answers
Question 1: Which cryptographic hash function is considered NIST-approved and produces a 256-bit digest?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- RIPEMD-160
Correct answer: SHA-256
SHA-256 is part of the NIST-approved SHA-2 family and produces a 256-bit hash output.
Question 2: What is the Diffie-Hellman key exchange primarily used for?
- Encrypting large data files
- Authenticating users to a server
- Establishing a shared secret over an insecure channel (Correct answer)
- Generating digital signatures
Correct answer: Establishing a shared secret over an insecure channel
Diffie-Hellman allows two parties to derive a shared secret over a public channel without ever transmitting the secret itself.
Question 3: A certificate with the 'KeyUsage' extension set to 'keyCertSign' can perform which function?
- Encrypt session keys
- Sign other certificates (Correct answer)
- Authenticate to web servers
- Generate key pairs
Correct answer: Sign other certificates
The keyCertSign KeyUsage bit authorizes a certificate's public key for verifying signatures on subordinate certificates.
Question 4: Which of the following best describes a rainbow table attack?
- Brute-forcing every possible password
- Using precomputed hash chains to reverse password hashes (Correct answer)
- Intercepting hashed passwords in transit
- Injecting malicious SQL to extract password tables
Correct answer: Using precomputed hash chains to reverse password hashes
A rainbow table attack uses precomputed chains of hash values to efficiently look up the plaintext corresponding to a given hash.
Question 5: What is the purpose of adding a 'salt' to a password before hashing?
- To increase hash computation speed
- To make two identical passwords produce different hashes (Correct answer)
- To encrypt the hash output
- To extend the length of the password
Correct answer: To make two identical passwords produce different hashes
A salt is a random value added to each password before hashing, ensuring identical passwords produce unique hashes and defeating precomputed attacks.
Question 6: In a PKI hierarchy, what is the role of an intermediate (subordinate) CA?
- To generate end-entity key pairs
- To issue certificates on behalf of the root CA, keeping the root offline (Correct answer)
- To host the certificate repository
- To process OCSP queries from clients
Correct answer: To issue certificates on behalf of the root CA, keeping the root offline
Intermediate CAs issue end-entity certificates while allowing the root CA to remain offline, limiting exposure of the most trusted key.
Question 7: Which algorithm is an example of an elliptic curve cryptography (ECC) signature scheme?
- RSA
- AES-GCM
- ECDSA (Correct answer)
- HMAC-SHA256
Correct answer: ECDSA
ECDSA (Elliptic Curve Digital Signature Algorithm) uses elliptic curve math to produce digital signatures with smaller key sizes than RSA.
SSCP Cryptography & PKI 3
Which cryptographic hash function is considered NIST-approved and produces a 256-bit digest?