Cryptography and Network Security MCQ Questions And Answers

Cryptography and Network Security MCQ Questions And Answers

91. What is a keylogger and how does it steal cryptographic credentials?

  1. A keylogger is a legitimate accessibility tool that records keyboard input for user assistance
  2. A keylogger is malicious software or hardware that secretly records keystrokes — capturing passwords, credit card numbers, and other sensitive information before encryption can protect it, since the data is captured at the point of entry before any cryptographic protection is applied
  3. Keyloggers can only capture text typed in web browsers and cannot intercept application inputs
  4. Keyloggers are prevented by using strong passwords — longer passwords take more time to log

Answer : B
Explanation: Keyloggers bypass all cryptographic protection by intercepting data before it is encrypted. Types: Software keyloggers: API-based: hooks into keyboard APIs, intercepts keystrokes application-level. Kernel-based (rootkit): operates in kernel space, harder to detect. Form grabbers: intercept form data before HTTPS submission. Browser extensions: malicious browser plugins capturing everything typed. Hardware keyloggers: physical devices between keyboard and computer. Tiny devices — easily missed in physical security audits. Firmware-based: hidden in keyboard firmware. Attack impact: captures passwords as typed → all encryption of the transmitted password is useless. Captures private keys entered as passwords for certificate management. Captures credit card numbers, bank account numbers, social security numbers. Bypasses 2FA if attacker monitors in real-time (AiTM attacks). Detection: antivirus behavioral analysis. Endpoint Detection and Response (EDR) tools. Anomalous process accessing keyboard APIs. Hardware: physical inspection, USB device auditing. Countermeasures: MFA (hardware tokens like FIDO2 do not involve typing the one-time secret). On-screen keyboards (defeats keystroke loggers but not screenshot grabbers). Endpoint protection. Anti-keylogger software. Physical port controls. FIDO2/WebAuthn: passkeys do not involve keyboard entry at all — completely immune to keyloggers.

92. What is HTTPS HSTS (HTTP Strict Transport Security)?

  1. HSTS is an HTTP header that speeds up HTTPS connections by caching encryption parameters
  2. HSTS is a web security policy mechanism where a website instructs browsers to only access it over HTTPS for a specified period — preventing protocol downgrade attacks and SSL stripping by ensuring browsers never attempt an insecure HTTP connection to the site
  3. HSTS is a server-side certificate management protocol for automating TLS certificate renewal
  4. HSTS only works on Chrome browsers and is not supported by Firefox, Safari, or Edge

Answer : B
Explanation: HSTS (HTTP Strict Transport Security) prevents downgrade attacks and cookie hijacking. Problem without HSTS: user types bank.com (no https://). Browser first makes HTTP request → attacker intercepts (SSL stripping). Attacker serves HTTP page to user while maintaining HTTPS to bank. User never sees HTTPS — credentials stolen. HSTS solution: server sends header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. Browser caches this for max-age seconds (1 year in example). For 1 year: browser NEVER makes HTTP requests to this domain. All requests automatically upgraded to HTTPS. HTTP connections refused even before they leave the browser. If certificate is invalid → browser shows error, refuses connection (cannot click through). HSTS Preload: even the FIRST connection is protected. Browser manufacturers maintain a list of HSTS-preloaded domains. Submitted to: hstspreload.org. Chrome, Firefox, Safari, Edge include this list. Sites like google.com, facebook.com, twitter.com are preloaded. Requirement for preload: serve HTTPS correctly, redirect HTTP to HTTPS, include preload in HSTS header. Limitation: TOFU (Trust On First Use) — first visit without preload still potentially vulnerable. HSTS Preload eliminates this. includeSubDomains: applies HSTS to all subdomains (requires all subdomains to have valid HTTPS). Impact: major driver of HTTPS adoption across the web.

93. What is a Trojan horse in cybersecurity and how does it work?

  1. A Trojan horse is a type of network router that secretly routes traffic to unauthorized destinations
  2. A Trojan horse is malware disguised as legitimate, useful software — once installed, it performs malicious actions such as creating backdoors, stealing data, downloading additional malware, or providing remote access to attackers, without the user’s knowledge
  3. Trojan horses spread automatically through networks like computer viruses do
  4. A Trojan horse attack can only work on computers with outdated antivirus software installed

Answer : B
Explanation: Trojan Horse (named after Greek mythology — gift concealing soldiers). Unlike viruses and worms, Trojans do NOT self-replicate. They rely on social engineering to get users to install them. Types: Remote Access Trojan (RAT): gives attacker remote control. Full desktop control, file access, webcam/microphone activation. Examples: DarkComet, NjRAT, njw0rm. Backdoor Trojan: creates hidden access point bypassing authentication. Banking Trojan: steals banking credentials, intercepts transactions. Zeus, Emotet, TrickBot. Downloader Trojan: downloads and installs additional malware. Often first stage of multi-stage attacks. Rootkit Trojan: hides malware presence from security tools. Droppers: install other malware payloads. Keylogger Trojans: capture keystrokes. Delivery methods: Malicious email attachments (Word macros, PDF exploits). Fake software downloads (free games, utilities, cracks). Drive-by downloads (exploit browser vulnerabilities). Bundled with legitimate software (PUPs — Potentially Unwanted Programs). USB drives left in parking lots. Cryptographic evasion: Trojans encrypt their payload to evade signature-based AV. Code obfuscation, polymorphism. Living-off-the-land: use legitimate Windows tools (PowerShell, WMI) to avoid detection. Defense: Application allowlisting. Behavioral-based endpoint detection. Email security gateways. User training (don’t run attachments). Principle of least privilege (limits damage).

94. What is a digital signature standard (DSS) and what algorithms does it specify?

  1. DSS is a standard that specifies how digital signatures must be physically printed on paper documents
  2. DSS (Digital Signature Standard) is a NIST standard (FIPS 186) that specifies algorithms for generating and verifying digital signatures — specifying DSA, RSA-based signing, and ECDSA with SHA-family hash functions
  3. DSS is a proprietary algorithm developed by Microsoft for Windows code signing operations
  4. DSS only applies to government documents and cannot be used for commercial digital signatures

Answer : B
Explanation: DSS (Digital Signature Standard), FIPS 186, published by NIST specifies approved digital signature algorithms. FIPS 186-5 (current, 2023) approved algorithms: DSA (Digital Signature Algorithm): designed specifically for digital signatures (not encryption). Security based on discrete logarithm problem. Key sizes: 2048/3072 bits. Being deprecated in FIPS 186-5 (no longer approved for new applications). RSA Signature Schemes: RSASSA-PSS (Probabilistic Signature Scheme): recommended for RSA. Better security properties than older PKCS#1 v1.5. RSASSA-PKCS1-v1_5: legacy, still used in TLS/code signing. ECDSA (Elliptic Curve DSA): smaller signatures and keys than RSA/DSA. Curves: P-256 (NIST P-256, secp256r1), P-384, P-521. Used in Bitcoin, TLS 1.3 certificates. EdDSA (Edwards-curve DSA): newer, simpler, faster. Ed25519 (most common): 256-bit keys, ~100 bytes signature. Resistant to timing attacks. Used in SSH keys, Signal Protocol, WireGuard. All must use SHA-2 or SHA-3 family hash functions. SHA-1 no longer approved for digital signatures. Applications: TLS/HTTPS server certificates use ECDSA or RSA. Code signing (Windows Authenticode, Apple, Android) uses RSA or ECDSA. Email signing (S/MIME) uses RSA or ECDSA. PDF/contract signing. Government credentials (PIV cards) use ECDSA P-256.

95. What is the concept of defense in depth in network security?

  1. Defense in depth means having a very deep (thick) security perimeter around the network
  2. Defense in depth is a security strategy that uses multiple, layered, independent security controls so that if one control fails, others remain to prevent or detect an attack — no single point of failure in the security architecture
  3. Defense in depth means defending only the deepest (most sensitive) systems with strong security controls
  4. Defense in depth is only applicable to large enterprises and is too costly for small businesses

Answer : B
Explanation: Defense in Depth (DiD) originated as a military strategy — slow down the enemy at multiple defensive lines rather than relying on one strong perimeter. Security layers (a typical enterprise DiD architecture): Physical: guards, locks, badge access, CCTV, cages, mantraps. Perimeter: edge firewall, DDoS mitigation, ISP filtering. Network: next-generation firewall, IPS, network segmentation, VLANs, NAC. Host: endpoint protection (EDR/XDR), host firewall, patch management, application allowlisting, HIDS. Application: secure coding (OWASP), WAF, input validation, authentication, authorization. Data: encryption at rest (AES), encryption in transit (TLS), data loss prevention (DLP), database activity monitoring. Identity: MFA, PAM, least privilege, RBAC, zero trust. Monitoring: SIEM, SOC, threat intelligence, anomaly detection, incident response. The “assumed breach” mindset: even if an attacker gets through the perimeter (they will, eventually), what stops them from reaching sensitive data? Lateral movement barriers, data encryption, monitoring, and detection. Real-world example: even if phishing delivers malware (perimeter breach), EDR detects behavior (host layer), network segmentation prevents spread (network layer), sensitive data is encrypted (data layer), SIEM alerts the SOC (monitoring layer). Each layer buys time for detection and response.

96. What is a security information and event management (SIEM) system?

  1. A SIEM is a single antivirus program that protects all devices on a network simultaneously
  2. A SIEM is a platform that aggregates, correlates, and analyzes security events and log data from across the entire IT infrastructure in real time — enabling threat detection, incident response, and compliance reporting by identifying patterns that individual security tools would miss
  3. SIEM systems are only used for compliance reporting and have no real-time threat detection capability
  4. A SIEM replaces all other security tools and is the only security control needed in an organization

Answer : B
Explanation: SIEM (Security Information and Event Management) is the central nervous system of a security operations center (SOC). Two components: SIM (Security Information Management): log collection, storage, reporting. SEM (Security Event Management): real-time correlation, alerting, dashboards. SIEM capabilities: Log aggregation: collects logs from firewalls, IDS/IPS, servers, applications, cloud services, endpoints. Normalization: converts different log formats to a standard format for analysis. Correlation: links related events across different systems to identify attack patterns. Example: failed logins (firewall) + successful login from new country (identity) + large data transfer (network) → potential account compromise alert. Alerting: generates security alerts when correlation rules match. Dashboards: real-time visibility into security posture. Forensic search: investigate incidents by searching historical logs. Compliance reporting: automated reports for PCI DSS, HIPAA, SOX. Use case example: Single firewall alert for one failed login → noise. SIEM correlation: 500 failed logins against 100 accounts in 10 minutes from same IP → brute force attack alert + automatic block. Commercial SIEMs: Splunk (market leader), IBM QRadar, Microsoft Sentinel (cloud-native), Elastic SIEM, LogRhythm. SIEM + SOAR (Security Orchestration, Automation, and Response): SIEM detects threats, SOAR automates incident response (automatically block IP, isolate host, send ticket).

97. What is a Man-in-the-Browser (MitB) attack?

  1. A MitB attack is a denial of service attack targeting web browsers specifically
  2. A Man-in-the-Browser attack is a type of MITM attack where malware (typically a browser extension or Trojan) infects a web browser — manipulating transactions in real time after authentication, allowing attackers to alter web transactions (e.g., changing bank transfer amounts) while showing the victim a legitimate-looking confirmation
  3. MitB attacks can only be performed by the website operator on their own visitors
  4. Man-in-the-Browser is only possible in Internet Explorer and not in modern browsers

Answer : B
Explanation: Man-in-the-Browser is one of the most sophisticated financial fraud techniques. How it works: Trojan or malicious browser extension installs in victim’s browser. Victim logs into bank normally — authentication succeeds. MitB malware hooks into browser APIs (BHO for IE, WebExtension APIs). When victim initiates transfer: MitB intercepts the transaction. Changes payee account and amount. Sends modified transaction to bank. Modifies the confirmation page to show original details. Victim sees: “Transfer $100 to John” — actually transferred $10,000 to attacker. Bank sees: valid authenticated session. Hard to detect: authentication is legitimate. HTTPS is intact (malware operates after TLS decryption). SSL/TLS does NOT protect against MitB. Countermeasures: Transaction authentication numbers (TANs): one-time codes for specific transactions. Challenge: bank shows “Confirm transfer of $100 to account XXXX” — user must enter matching TAN. Device-independent out-of-band confirmation: call/SMS confirmation to separate device. Security software: browser protection modules that detect API hooking. MitB-aware antivirus signatures. Behavioral analytics: unusual transaction patterns. Hardware security keys (FIDO2): transaction signing on hardware device — even MitB cannot forge hardware signatures. This is why many banks send confirmation texts with transaction details — verifying the actual transaction, not just authentication.

98. What is the concept of key management in cryptography?

  1. Key management is the administrative process of organizing cryptographic practitioners in a company
  2. Key management encompasses the complete lifecycle of cryptographic keys — generation, distribution, storage, rotation, revocation, and destruction — ensuring keys remain secure, available, and properly controlled throughout their useful life
  3. Key management only applies to asymmetric keys — symmetric keys do not require management
  4. Key management is an automated process that requires no human oversight or policy decisions

Answer : B
Explanation: Key management is one of the most challenging aspects of practical cryptography. Key lifecycle: Generation: use a CSPRNG with sufficient entropy. Key material must be generated on a trusted system. Distribution: securely deliver keys to authorized parties. Key exchange protocols (DH, RSA). Out-of-band delivery for high-security scenarios. Storage: protect keys at rest. HSM (Hardware Security Module): tamper-resistant hardware key storage. Key encryption keys (KEK): encrypt data keys with a master key. Secrets management: HashiCorp Vault, AWS KMS, Azure Key Vault. NEVER: store keys in code, config files, or plain text. Use: keys used to encrypt/decrypt data. Access controls: who/what can use which keys. Usage audit logs. Rotation: regularly replace keys with new ones. Compromised key damage limited to data encrypted with that key. PKCS#11: standard API for HSM communication. Revocation: invalidate compromised or expired keys. CRL/OCSP for certificates. Archival: retain old keys to decrypt old data. Balance against security (old compromised keys still readable). Destruction: securely wipe key material when no longer needed. Cryptographic erasure: overwrite storage with random data. Common mistakes: hardcoding keys in source code (check GitHub — many exposed API keys found). Same key used forever (no rotation). Insecure key transmission (email, HTTP). No key backup (losing key = losing data). Key escrow: backup keys with trusted third party for disaster recovery — but must be secured.

99. What is OWASP and what are the most important security vulnerabilities it identifies?

  1. OWASP is a commercial cybersecurity company that sells vulnerability scanning software
  2. OWASP (Open Web Application Security Project) is a nonprofit foundation that produces freely available security resources — most notably the OWASP Top 10, a regularly updated list of the most critical web application security risks including injection, broken authentication, XSS, insecure design, and security misconfigurations
  3. OWASP only covers JavaScript security and does not address server-side or database vulnerabilities
  4. OWASP Top 10 is only relevant for large enterprises and does not apply to small web applications

Answer : B
Explanation: OWASP (Open Web Application Security Project) is a globally recognized authority on web application security. OWASP Top 10 (2021 — most recently updated): A01 — Broken Access Control: users accessing unauthorized resources. Most critical. A02 — Cryptographic Failures: sensitive data exposed (weak encryption, no HTTPS, hardcoded keys). A03 — Injection: SQL, NoSQL, OS, LDAP injection attacks. A04 — Insecure Design: missing security controls in architecture/design phase. A05 — Security Misconfiguration: default passwords, unnecessary features enabled, verbose error messages. A06 — Vulnerable and Outdated Components: unpatched libraries, frameworks with known vulnerabilities. A07 — Identification and Authentication Failures: broken authentication, session management issues. A08 — Software and Data Integrity Failures: unsigned updates, insecure CI/CD, deserialization flaws. A09 — Security Logging and Monitoring Failures: insufficient logging enabling undetected breaches. A10 — Server-Side Request Forgery (SSRF): server fetches attacker-controlled URLs. Other OWASP resources: OWASP Application Security Verification Standard (ASVS): detailed verification requirements. OWASP Software Assurance Maturity Model (SAMM): security program maturity. OWASP Mobile Security Testing Guide. OWASP Cheat Sheet Series: specific security implementation guidance. OWASP is the de facto standard reference for web application security — used by developers, penetration testers, and auditors globally.

100. What are the most important emerging trends in cryptography and network security?

  1. Cryptography is a solved science — no new developments are needed or expected in the near future
  2. Key emerging trends include post-quantum cryptography (NIST PQC standards), zero trust architecture, passwordless authentication (FIDO2/Passkeys), homomorphic encryption, confidential computing, AI-driven threat detection, and supply chain security — driven by quantum computing threats, increasing sophistication of attacks, and cloud-first architectures
  3. The only emerging trend is making current algorithms faster — no fundamental changes are needed
  4. All future cryptographic development is classified government research inaccessible to the public

Answer : B
Explanation: Cryptography and network security are rapidly evolving fields: Post-Quantum Cryptography (PQC): NIST standardized CRYSTALS-Kyber, CRYSTALS-Dilithium in 2022. Migration from RSA/ECC to PQC algorithms underway. Crypto-agility: design systems to swap algorithms. Zero Trust Architecture: “never trust, always verify.” Eliminate implicit network trust. Every access request verified: identity, device health, behavior. Technologies: ZTNA (Zero Trust Network Access), microsegmentation, SASE (Secure Access Service Edge). Passwordless Authentication: FIDO2/WebAuthn passkeys — phishing-resistant authentication. Apple, Google, Microsoft adopting broadly. Biometric + hardware security key. Homomorphic Encryption: compute on encrypted data without decrypting. Enables privacy-preserving cloud computing (data analyzed without being exposed). Still computationally expensive — practical use increasing. Confidential Computing: hardware-based trusted execution environments (TEE). Intel TDX, AMD SEV, AWS Nitro Enclaves. Process sensitive data in memory isolated from the hypervisor. AI/ML in Security: UEBA (User and Entity Behavior Analytics). AI-powered threat detection, anomaly detection. Adversarial AI: attackers using AI to generate polymorphic malware, spear phishing. LLM-based attacks. Supply Chain Security: SolarWinds, Log4Shell demonstrated supply chain risks. SBOM (Software Bill of Materials) tracking. Sigstore: code signing for open source. 5G Security: new cryptographic standards, slicing security. Edge Computing Security: IoT device attestation, lightweight cryptography (ASCON — new NIST LWC standard).

Pages: 1 2 3 4 5 6 7 8 9 10