01
True or false
1 point
A team emails a file and its unkeyed SHA-256 digest together. Does the digest alone prove that the file came from the team?
Free Practice Quiz Question List
9 Applied Cryptography Practice Online Quiz Questions
Use this free practice quiz with 20 questions to review 9 Applied Cryptography Practice, test your knowledge, and prepare for your next test or exam.
20 questions
02
Written response
1 point
A database must store user passwords so the original passwords cannot be recovered. What type of scheme should it use?
03
Fill in the blank
1 point
Two services share a secret key. To detect message changes and authenticate that the sender holds the key, use .
04
Choose one
1 point
A service stores a private customer record that only authorized services should read. Which protection best meets the confidentiality goal while also detecting tampering?
- A
Store the record with a plain hash of its contents.
- B
Encrypt it using authenticated encryption such as AES-GCM, with a securely managed key.
- C
Encrypt it using a reversible scheme without an authentication check.
- D
Store it in plaintext and rely on access controls alone.
05
True or false
1 point
When using AES-GCM, a nonce must not be reused with the same key.
- A
True
- B
False
06
Fill in the blank
1 point
When encrypting a message, an unencrypted protocol version or record identifier can be bound to it as .
07
Choose one
1 point
A digital signature on a document verifies successfully with a public key. What conclusion is justified by that result alone?
- A
The document is confidential because it was signed.
- B
The document matches a signature made with the private key corresponding to the verification key.
- C
The signer’s real-world identity is established automatically, regardless of how the public key was obtained.
- D
The document cannot have been changed since it was signed, even if verification fails.
08
Written response
1 point
When verifying a publisher’s digital signature, what exact representation of the document must be used as the message input?
09
Choose all
1 point
A service receives a confidential message encrypted with AES-GCM. Select all actions the receiver should take.
- A
Transmit the nonce, ciphertext, and authentication tag.
- B
Verify the authentication tag before accepting or using the plaintext.
- C
If tag verification fails, process the partially decrypted plaintext anyway.
- D
Reject the message if authentication fails.
10
Choose one
1 point
After a planned key rotation, existing records still need to be read and new records must be protected. Which recovery plan best meets both needs?
- A
Discard the old key immediately and keep writing records with it until the decryption problem is resolved.
- B
Restrict and audit necessary access to the old key for existing records, use the new key for new records, and re-encrypt old records when appropriate before retiring the old key.
- C
Use the old key for all new records until every existing record has been decrypted.
- D
Make all stored records accessible by disabling key checks.
11
Choose all
1 point
A browser receives a server certificate, an intermediate certificate, and a root certificate already trusted by the operating system. Select all checks that should contribute to validation.
- A
Establish that the target certificate's path connects to an accepted trust anchor.
- B
Check certificate signatures, validity periods, and relevant constraints and usages.
- C
Check that the certificate identifies the requested service name.
- D
Trust the certificate if it is well-formed, even if its path is not accepted.
- E
Check that the certificate's public key is suitable for its intended use.
12
True or false
1 point
If a key may have been compromised, rotating it alone cannot undo an attacker's prior access to data they may already have decrypted.
- A
True
- B
False
13
Choose one
1 point
Which password-storage configuration best follows recommended practice?
- A
Encrypt passwords reversibly so the database can recover them.
- B
Use a password-hashing scheme with a unique salt and appropriate work settings.
- C
Store plain SHA-256 digests without salts because a hash cannot be reversed.
- D
Use the same salt for every user's password and omit work settings.
14
Open ended
1 point
After a deployment, a receiver reports authentication failures for messages encrypted with AES-GCM. Give a troubleshooting sequence and state how the receiver should handle any message that still fails verification.
15
Choose one
1 point
A database must store user passwords so that the original passwords cannot be recovered from it. Which approach best meets this goal?
- A
Use a password-hashing scheme with a unique salt and appropriate work settings.
- B
Encrypt passwords with AES-GCM so they can be decrypted when needed.
- C
Store a plain SHA-256 hash of each password.
- D
Use the same salt for every account to simplify verification.
16
Written response
1 point
Two services share a secret key and need the receiver to detect message changes and confirm that the sender held that key. What specific keyed construction does the material recommend?
17
Choose one
1 point
A service encrypts many messages with AES-GCM under one key. Which nonce-handling rule must it follow?
- A
Reuse a fixed nonce with the same key so both services can predict it.
- B
Never reuse a GCM nonce with the same key.
- C
Reuse a nonce whenever the plaintext is different.
- D
Include the nonce in the ciphertext and omit it from the message.
18
Written response
1 point
After key rotation, stored records may need different keys for decryption. What short identifier should each record carry so the application can select the correct key?
19
Choose one
1 point
A browser receives a server certificate, an intermediate certificate, and a root certificate already trusted by the operating system. Which validation approach is appropriate before relying on the server certificate?
- A
Accept the certificate if it is well-formed and contains a public key.
- B
Trust it if it is self-signed and its validity period has not expired.
- C
Validate its path to an accepted trust anchor and check signatures, validity, constraints, usages, and the requested service name.
- D
Accept it whenever the server supplies an intermediate certificate.
20
Choose one
1 point
A publisher supplies a signed document and a public key. Which action is necessary to verify that the signature matches the supplied document?
- A
Verify the signature against the exact document bytes using the correct algorithm and intended public key.
- B
Verify a reformatted copy of the document using any available public key.
- C
Use the signature to decrypt the document before checking it.
- D
Accept the signature if the document text appears unchanged to a reader.