SSCP Cryptography Practice Test 2 — 15 Questions

Question 1

An organization is implementing a digital signature solution to ensure non-repudiation of documents. Which combination of keys is used during the signing process?

Accepted Answer

Sender's private key to sign, sender's public key to verify. Digital signatures use asymmetric cryptography where the sender creates a signature with their private key, and the recipient verifies it with the sender's public key. This ensures non-repudiation because only the sender possesses their private key, so they cannot deny having signed the document. The process typically involves hashing the document and encrypting the hash with the sender's private key.

Answer

Recipient's public key to sign, recipient's private key to verify

Answer

Sender's public key to sign, recipient's private key to verify

Answer

A shared symmetric key for both signing and verification

Question 2

A company is deploying a VPN using IPsec. They want to ensure that even if the private key of the server is compromised, past session keys cannot be derived. Which key exchange method should they use?

Accepted Answer

Ephemeral Diffie-Hellman (DHE or ECDHE). Ephemeral Diffie-Hellman (DHE or ECDHE) provides perfect forward secrecy (PFS) because it generates a unique, temporary session key for each session using ephemeral key pairs. Even if the server's long-term private key is compromised, past session keys cannot be derived because they were created from ephemeral keys that are discarded after each session. This ensures that historical encrypted traffic remains secure.

Answer

Pre-shared key (PSK)

Answer

RSA key exchange

Answer

Diffie-Hellman with static keys

Question 3

A security administrator is configuring a web server to use TLS. They want to optimize performance while maintaining strong security. Which cipher suite should they prioritize?

Accepted Answer

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384. TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 uses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for perfect forward secrecy, ECDSA for efficient authentication, AES-256 in GCM mode for authenticated encryption, and SHA-384 for integrity. This combination provides the strongest security with modern, optimized algorithms, making it the best choice for performance and security on a TLS web server.

Answer

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

Answer

TLS_RSA_WITH_AES_128_CBC_SHA256

Answer

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Question 4

Which of the following hash algorithms is considered cryptographically broken and should be avoided due to collision attacks?

Accepted Answer

MD5. MD5 is known to have collision vulnerabilities and is no longer considered secure.

Answer

SHA-3

Answer

SHA-256

Answer

HMAC-SHA256

Question 5

An organization uses a PKI with a root CA that issues certificates to intermediate CAs, which then issue end-entity certificates. A client receives an end-entity certificate signed by an intermediate CA. During validation, which certificates are required to build the chain of trust?

Accepted Answer

End-entity certificate, intermediate CA certificate, and root CA certificate. In a PKI hierarchy, the chain of trust requires each certificate in the path to be validated up to a trusted root. The client must have the end-entity certificate, the intermediate CA certificate (to verify the end-entity's signature), and the root CA certificate (to verify the intermediate CA's signature). Without the intermediate CA certificate, the client cannot cryptographically link the end-entity to the root, breaking the chain.

Answer

Only the root CA certificate

Answer

Only the end-entity certificate and the root CA certificate

Answer

Only the end-entity certificate and the intermediate CA certificate

Question 6

A security engineer needs to choose an asymmetric algorithm for a system with limited computational resources, such as an IoT device. The algorithm must provide equivalent security to RSA 2048-bit while using smaller key sizes. Which algorithm should they choose?

Accepted Answer

Elliptic Curve Cryptography (ECC) with 256-bit keys. Elliptic Curve Cryptography (ECC) with 256-bit keys provides equivalent security to RSA 2048-bit because the elliptic curve discrete logarithm problem is significantly harder to solve than the integer factorization problem for the same key length. This allows ECC to achieve strong security with much smaller key sizes, making it ideal for resource-constrained IoT devices where memory, power, and processing are limited.

Answer

RSA with 2048-bit keys

Answer

Diffie-Hellman with 2048-bit keys

Answer

3DES with 168-bit keys

Question 7

A security auditor reviews a system that uses HMAC-SHA256 for message authentication. Which property does HMAC provide that a simple hash of the message does not?

Accepted Answer

Integrity and authentication using a shared secret. HMAC-SHA256 uses a shared secret key combined with the message before hashing, which provides both integrity (detecting tampering) and authentication (verifying the sender knows the secret). A simple hash of the message alone offers integrity but no authentication, because anyone can compute the same hash without a secret. Thus, HMAC adds authentication via the shared secret, making option C correct.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Forward secrecy

Question 8

Which of the following is a secure protocol for remote administration of a server, replacing insecure protocols like Telnet?

Accepted Answer

SSH. SSH (Secure Shell) is the correct answer because it provides encrypted remote administration capabilities, replacing insecure protocols like Telnet that transmit data in plaintext. SSH uses public-key cryptography for authentication and symmetric encryption (e.g., AES, ChaCha20) for session confidentiality, protecting against eavesdropping and man-in-the-middle attacks.

Answer

FTP

Answer

HTTP

Answer

Telnet

Question 9

A company wants to implement a key management system. They need to generate cryptographic keys that are unpredictable. Which source of randomness should be used?

Accepted Answer

Hardware random number generator (HRNG). A hardware random number generator (HRNG) is the correct choice because it derives randomness from physical processes (e.g., thermal noise, quantum effects) that are inherently unpredictable and non-deterministic. Cryptographic key generation requires true entropy to resist brute-force and prediction attacks, which software-based deterministic methods cannot guarantee.

Answer

Random numbers from a website

Answer

Linear congruential generator (LCG)

Answer

Pseudorandom number generator (PRNG) seeded with current timestamp

Question 10

A certificate authority (CA) issues a certificate with the extended key usage (EKU) extension specifying 'serverAuth'. Which of the following is this certificate allowed to do?

Accepted Answer

Authenticate a TLS server. The Extended Key Usage (EKU) extension specifies the intended purpose of a certificate. The 'serverAuth' OID (1.3.6.1.5.5.7.3.1) explicitly permits the certificate to be used for authenticating a TLS server during the SSL/TLS handshake, such as in HTTPS. This is defined in RFC 5280 and is enforced by TLS clients to ensure the certificate is used only for its designated purpose.

Answer

Encrypt email

Answer

Sign code

Answer

Issue subordinate CA certificates

Question 11

Which of the following is a method to check the revocation status of a digital certificate in real-time without the client downloading a full list?

Accepted Answer

Online Certificate Status Protocol (OCSP). OCSP allows querying the CA's responder for the status of a specific certificate in real-time.

Answer

Certificate Revocation List (CRL)

Answer

Self-signed certificate validation

Answer

Certificate Transparency (CT)

Question 12

An organization is designing a secure email system using S/MIME. Which of the following are essential components of the PKI that must be in place? (Select THREE)

Accepted Answer

X.509 digital certificates for each user. S/MIME relies on a PKI where each user possesses an X.509 digital certificate that binds their identity to a public key. This certificate is essential for signing and encrypting emails, as it allows recipients to verify the sender's identity and encrypt messages using the sender's public key.

Answer

A symmetric key distribution center (KDC)

Answer

A timestamp authority (TSA)

Question 13

A company is migrating from 3DES to a modern encryption algorithm. Which of the following are acceptable choices? (Select TWO)

Accepted Answer

ChaCha20. AES and ChaCha20 are modern symmetric ciphers considered secure. RC4 is broken, Blowfish is older (64-bit block), and DES is obsolete.

Answer

DES

Answer

RC4

Answer

Blowfish

Question 14

An organization is migrating from 3DES to AES-256 for encrypting data at rest. Which mode of AES is recommended for authenticated encryption?

Accepted Answer

GCM. GCM (Galois/Counter Mode) is the correct choice because it provides both confidentiality and authenticity in a single, efficient mode. For data at rest, authenticated encryption ensures that encrypted data cannot be tampered with undetected, which is critical for integrity. AES-256-GCM is widely recommended and standardized (NIST SP 800-38D) for this purpose.

Answer

ECB

Answer

CBC

Answer

CTR

Question 15

A security analyst is reviewing a digital signature implementation. The signer uses their private key to encrypt the hash of a message. What does the recipient use to verify the signature?

Accepted Answer

The signer's public key. Digital signatures use asymmetric cryptography where the signer encrypts the message hash with their private key. The recipient decrypts that encrypted hash using the signer's public key, then compares it to a locally computed hash of the received message. If they match, the signature is verified, proving both authenticity and integrity.

Answer

The recipient's private key

Answer

The signer's private key

Answer

The recipient's public key