Free Practice Quiz Question List

6 Cryptography Fundamentals Online Quiz Questions

Use this free practice quiz with 20 questions to review 6 Cryptography Fundamentals, test your knowledge, and prepare for your next test or exam.

20 questions

Fill in the blank

1 point

In symmetric encryption, the is used to encrypt and decrypt data.

Fill in the blank

1 point

A cryptographic hash function maps data of any length to a .

Choose one

1 point

Which design is appropriate for storing user passwords securely?

A
Store each password in plaintext so it can be recovered when needed.
B
Use a password-hashing scheme with a unique salt and appropriate work factors.
C
Store one fast hash of each password without a salt.
D
Encrypt all passwords with a key hard-coded into the application.

Written response

1 point

What keyed mechanism can two parties that share a secret use to check that a message was not modified and came from someone who knows that key?

True or false

1 point

True or false: A digital signature, by itself, encrypts the signed data so that only the holder of the matching public key can read it.

A
True
B
False

Choose one

1 point

A system uses AES-GCM to encrypt a message and supplies an unencrypted header as associated data. Which protection does this construction provide when used correctly?

A
It encrypts data but cannot detect alteration to the ciphertext.
B
It provides confidentiality and checks for alteration of both encrypted data and associated data.
C
It replaces the need to generate a nonce according to the algorithm’s requirements.

Written response

1 point

After key agreement produces shared secret material, what kind of function is generally used to derive purpose-specific keys?

Choose all

1 point

Which practices support sound cryptographic key management? Select all that apply.

A
Generate keys with a cryptographically secure random-number generator.
B
Hard-code secret keys in source code so every server can access them easily.
C
Use different keys for different purposes.
D
Establish clear ownership and rotation procedures.

Choose one

1 point

A browser validates a website’s public-key certificate, including the requested name and certificate chain. What conclusion is justified by a successful validation?

A
It guarantees that the website is safe and its operator is honest.
B
It helps authenticate the named entity when the certificate and its chain pass the client’s validation rules.
C
It makes the certificate’s public key secret.
D
It proves that the certificate subject personally approved every action taken by the website.

True or false

1 point

True or false: Key exchange alone authenticates the communicating parties and prevents an attacker from establishing separate keys with each of them.

A
True
B
False

Choose all

1 point

Which statements correctly describe the forward-secrecy protection associated with ephemeral Diffie–Hellman? Select all that apply.

A
Ephemeral Diffie–Hellman key exchange can provide forward secrecy.
B
Forward secrecy requires the long-term authentication key to remain secret forever.
C
Ephemeral secrets and session keys must be handled and erased appropriately for this protection to hold.
D
Provided ephemeral secrets and session keys are handled and erased appropriately, later compromise of the long-term authentication key alone does not reveal previously recorded session traffic.

Choose one

1 point

Two parties need to protect a large amount of data efficiently. Which approach best fits that need while addressing the key-sharing challenge?

A
Use asymmetric encryption for all data because its private key can be shared between the parties.
B
Use symmetric encryption for the data and arrange a secure way to establish and protect the shared key.
C
Use a plain hash to encrypt the data, then decrypt it with the public key.
D
Use a digital signature to conceal the data from anyone without the signing key.

True or false

1 point

True or false: If a recipient receives a message and its plain hash from the same untrusted sender, matching them proves who created the message.

A
True
B
False

Choose one

1 point

A client and service share a secret key and need to check that a message was created by someone who knows that key and was not modified. Which mechanism should they use?

A
Use a message authentication code (MAC) based on the shared secret.
B
Use a plain hash, since hashing proves which party created the message.
C
Encrypt the message with a public key, since encryption alone proves its sender.
D
Use a certificate as the message contents, since certificates detect any message change.

Written response

1 point

Password-storage guidance calls for a unique value for each password, in addition to a password-hashing scheme designed to resist guessing. What is this per-password value called?

Choose one

1 point

A user wants to check that a software release has not changed and was signed using the publisher's private key. The release need not be kept secret. What should the user's system do?

A
Encrypt the release with the publisher's private key so the user can recover its contents.
B
Hash the release and trust the hash without checking how it was provided.
C
Verify a digital signature on the release using the publisher's trusted public key.
D
Use the publisher's public key as a shared secret to encrypt the release.

Choose one

1 point

A client connects to a website using a certificate. Which validation approach best supports checking that the public key is associated with the requested website identity?

A
Accept the certificate because any certificate makes its website safe and its operator honest.
B
Check whether the certificate validly associates the public key with the requested name and chains to a trust anchor the client accepts.
C
Treat the certificate's public key as secret and use secrecy as proof of the website's identity.
D
Trust the certificate only if it contains a digital signature that encrypts the website's content.

Written response

1 point

After key exchange establishes shared secret material, what kind of function is generally used to produce keys for specific purposes?

Choose one

1 point

A system encrypts multiple messages with AES-GCM. What is the security concern if it reuses a nonce with the same key?

A
It makes the public key secret, preventing clients from checking the ciphertext.
B
It converts AES-GCM into a password-hashing scheme that resists guessing.
C
It guarantees that any associated data can be altered without detection.
D
It can seriously undermine security, so the nonce must be used according to the algorithm's requirements.

Open ended

1 point

A team selects a strong cryptographic algorithm and concludes that its system is secure. Explain why that conclusion is not justified, and describe two non-algorithm factors that can affect the system’s security.