01
True or false
1 point
True or false: A correctly configured TLS connection automatically determines whether the caller is allowed to perform a requested action.
Free Practice Quiz Question List
8 Cryptographic Applications and Secure Implementation Online Quiz Questions
Use this free practice quiz with 20 questions to review 8 Cryptographic Applications and Secure Implementation, test your knowledge, and prepare for your next test or exam.
20 questions
02
Written response
1 point
What cryptographic mechanism lets parties sharing a secret key verify a message's integrity and authenticity? Enter the term or its standard acronym.
03
Choose one
1 point
A service receives data accompanied by a digital signature. Which claim best describes what the signature can provide?
- A
It conceals the data so only the private-key holder can read it.
- B
It lets recipients verify the data using a public key and provides evidence that the corresponding private-key holder signed it.
- C
It proves that the data was created by whoever possesses the recipient's public key.
- D
It prevents a signed request from being replayed.
04
Fill in the blank
1 point
An application authenticates a record ID without encrypting it. During decryption, it must supply the same that was supplied during encryption.
05
Written response
1 point
Authenticated decryption reports that the authentication check failed. What must the application do with the data? Enter a concise action.
06
Choose one
1 point
An application must store a confidential report so that unauthorized changes can also be detected. Which choice best meets both requirements?
- A
A fast general-purpose hash, because it conceals the original data and detects changes.
- B
Encryption without authentication, because encrypted data cannot be altered.
- C
Authenticated encryption, such as AES-GCM or AES-CCM.
- D
A digital signature alone, because it encrypts the stored record.
07
Choose all
1 point
An API accepts signed tokens for requests to sensitive endpoints. Which practices should it use? Select all correct answers.
- A
Validate the token signature and relevant claims, such as issuer, audience, and expiration.
- B
Treat any valid token as permission to access every endpoint.
- C
Check whether the authenticated identity may perform this action on this resource.
- D
Skip server certificate validation because the token is signed.
08
True or false
1 point
True or false: Storing passwords as unkeyed hashes from a fast general-purpose hash function is an appropriate password-storage design.
- A
True
- B
False
09
Fill in the blank
1 point
An application uses AES-GCM. It must not reuse a nonce with the same .
10
Choose one
1 point
A service must encrypt large files and detect if an attacker rearranges, removes, or substitutes chunks. Which approach is most appropriate?
- A
Split the file into chunks and encrypt each independently without authenticating chunk order.
- B
Use a vetted streaming or file-encryption format that authenticates chunks and relevant ordering or file metadata.
- C
Hash the complete file once and store the hash beside the plaintext.
- D
Use TLS while uploading the file, then store it without encryption.
11
Choose all
1 point
A payment service must protect requests in transit, restrict who can make payments, protect stored payment records, and address replay risk. Which controls should it use? Select all correct answers.
- A
Protect the request in transit with correctly configured TLS.
- B
Authenticate the caller and check permission to make the payment.
- C
Encrypt the payment record in storage if it must remain confidential.
- D
Use unique request identifiers and duplicate detection if replay is a concern.
- E
Rely on a valid signature alone to prevent a request from being replayed.
12
Choose one
1 point
A client connects to an API over TLS. Which certificate-checking practice best helps prevent the client from accepting an impersonating server?
- A
Check only that the certificate is present; TLS encryption makes identity checks unnecessary.
- B
Validate the certificate chain but ignore the intended hostname.
- C
Validate the certificate chain, validity period, and intended hostname or identity.
- D
Disable certificate validation when the API uses an access token.
13
Choose one
1 point
A system uses envelope encryption and must rotate its key-encryption key. Which action can avoid re-encrypting all the stored data?
- A
Decrypt every record and re-encrypt it with a new data-encryption key.
- B
Replace the ciphertext with a hash, then discard all keys.
- C
Store the new key-encryption key beside the plaintext so services can access it more easily.
- D
Rewrap the data-encryption key under the new key-encryption key.
14
Open ended
1 point
An organization encrypts its backups and stores them separately from its production systems. Explain why encryption alone does not guarantee that the backups will remain usable or secure, and describe key-management measures the organization should plan.
15
Choose one
1 point
An application stores a confidential report and must detect unauthorized changes to it. Which approach best meets both requirements?
- A
Authenticated encryption, such as AES-GCM
- B
Encryption without an authentication check
- C
An unkeyed cryptographic hash
- D
A digital signature alone
16
True or false
1 point
True or false: A digital signature, by itself, encrypts the signed data so that only the intended recipient can read it.
- A
True
- B
False
17
Choose one
1 point
An API client connects to a service over HTTPS. Which certificate-handling approach helps protect the client from connecting to an impersonating server?
- A
Accept any certificate as long as the connection uses HTTPS.
- B
Validate the certificate chain, validity period, and intended hostname or identity.
- C
Check only that the server presents a public key.
- D
Skip certificate checks when the request contains a signed token.
18
Choose one
1 point
A service uses envelope encryption and needs to rotate its key-encryption key (KEK). Which action can avoid re-encrypting all the stored data?
- A
Decrypt all the data and encrypt it again with the new KEK.
- B
Replace the KEK in storage without changing how the DEK is protected.
- C
Rewrap the DEK under the new KEK without re-encrypting the data.
- D
Publish the old KEK so that stored data remains accessible during rotation.
19
Written response
1 point
What keyed mechanism lets parties that share a secret key verify a message's integrity and authenticity?
20
Written response
1 point
A payment service must reduce the risk that a previously valid request is processed again. Name one workflow control that can help prevent replay.