GSEC Practice Questions: Cryptography Domain

Correct Answer: C

Explanation: The most likely cause of emails being intercepted and read is that they are being sent without encryption (Option C). PGP requires that emails be encrypted with the recipient's public key to ensure confidentiality. If emails are sent in plaintext, they can be easily intercepted and read. Option A is incorrect because while storing private keys publicly is a security risk, it would not allow emails to be read unless those keys are also used without encryption. Option B is incorrect as PGP itself is not outdated, though specific implementations might be. Option D is incorrect because a weak passphrase would compromise key security, but it would not directly result in emails being readable if they were properly encrypted.

Correct Answer: C

Explanation: AES is commonly used for encrypting data in VPNs due to its strong security and efficiency. SHA-256 (A) is a hashing algorithm, not used for encryption. RSA (B) is typically used for key exchange, not for encrypting bulk data. Diffie-Hellman (D) is used for securely exchanging cryptographic keys over a public channel, not for encrypting data.

Correct Answer: B

Explanation: B is correct because obtaining the server's private key allows the analyst to decrypt the TLS session if the traffic was recorded and the session keys are still valid. A is incorrect because a man-in-the-middle attack is not feasible after the fact. C is incorrect because brute-forcing session keys is computationally infeasible. D is incorrect because exploiting weak ciphers is not a reliable or efficient method for decrypting traffic.

Correct Answer: C

Explanation: An HMAC provides data integrity and authenticity by combining a hash function with a secret key, making it suitable for ensuring data integrity in VPN communications. Option A provides confidentiality but not integrity. Option B ensures authenticity but is not specifically for integrity. Option D provides confidentiality and authenticity but is less efficient for integrity checks compared to HMAC.

Correct Answer: B

Explanation: Option B is correct because using a strong cipher suite that supports forward secrecy ensures that even if the server's private key is compromised, past communications remain secure. Option A is incorrect because self-signed certificates can lead to trust issues and are not suitable for production environments. Option C is incorrect because disabling certificate validation undermines the security provided by TLS. Option D is incorrect because TLS 1.0 is outdated and vulnerable to several attacks.

Correct Answer: A

Explanation: Updating the OpenSSL libraries to the latest version is the most effective way to mitigate vulnerabilities without disrupting services. Option B is not practical due to potential compatibility and support issues. Option C would unnecessarily disrupt services. Option D does not address the vulnerability and could block legitimate traffic.

Correct Answer: A

Explanation: Self-signed certificates are not inherently trusted by clients, making them susceptible to man-in-the-middle attacks since clients cannot verify the authenticity of the server. Option B is incorrect because self-signing does not affect computational overhead. Option C is incorrect because self-signed certificates can still encrypt data. Option D is incorrect because self-signing typically reduces the need for renewal management.

Correct Answer: B

Explanation: Option B is correct because signing the files with the sender's private key ensures integrity and authenticity, allowing recipients to verify the sender's identity. Option A is incorrect because encryption is done with the recipient's public key, not their private key. Option C is incorrect because compression does not affect integrity or authenticity. Option D is incorrect because symmetric keys do not provide a mechanism for signing.

Correct Answer: A

Explanation: A is correct because disabling outdated protocols like SSL and older versions of TLS reduces the risk of attacks exploiting known vulnerabilities. B is incorrect because increasing key length does not address protocol vulnerabilities. C is incorrect because while enabling PFS is good practice, it does not mitigate the risks associated with outdated protocols. D is incorrect because a self-signed certificate does not improve protocol security and may reduce trust.

Correct Answer: C

Explanation: Option C is correct because the command uses GnuPG (gpg) with the AES256 cipher algorithm to symmetrically encrypt the file, which is a secure method for encrypting data with AES-256. Option A, while using AES-256, employs the CBC mode, which can be vulnerable if not implemented with additional precautions like a secure IV management. Option B uses the DES algorithm, which is considered insecure due to its short key length. Option D also uses DES, which is outdated and insecure.