Cryptography and Network Security MCQ Questions And Answers

Cryptography and Network Security MCQ Questions And Answers

31. What is AES (Advanced Encryption Standard) and how does it differ from DES?

  1. AES is a stream cipher; DES is a block cipher — they use completely different encryption approaches
  2. AES is a symmetric block cipher with key sizes of 128, 192, or 256 bits that replaced the insecure 56-bit DES — AES is significantly stronger, faster, and is the current worldwide encryption standard used in Wi-Fi, HTTPS, and disk encryption
  3. AES uses asymmetric keys while DES uses symmetric keys for encryption operations
  4. AES and DES are identical algorithms — AES is just the newer name given to the updated DES

Answer : B
Explanation: AES (Advanced Encryption Standard) was selected by NIST in 2001 to replace the aging DES. Key differences: Key size — DES: 56-bit (easily cracked by brute force). AES: 128, 192, or 256 bits (AES-256 would take longer than the age of the universe to brute force). Block size — DES: 64-bit blocks. AES: 128-bit blocks. Structure — DES uses Feistel network (16 rounds). AES uses Substitution-Permutation network (10, 12, or 14 rounds for 128, 192, 256-bit keys). Speed — AES is faster than DES in both hardware and software. Security — DES was broken in 1999 in under 24 hours. AES has no practical attack. Triple-DES (3DES): applied DES three times to increase security but is now deprecated. AES use cases: WPA2/WPA3 Wi-Fi encryption, TLS/HTTPS, BitLocker/FileVault disk encryption, VPN tunnels, and virtually all modern symmetric encryption needs.

32. What is the RSA algorithm and what mathematical problem is its security based on?

  1. RSA is a symmetric encryption algorithm based on the difficulty of solving differential equations
  2. RSA is an asymmetric public-key cryptosystem whose security is based on the computational difficulty of factoring the product of two large prime numbers — widely used for secure key exchange, digital signatures, and encrypting small amounts of data
  3. RSA stands for Random Shift Algorithm and is based on random number generation difficulty
  4. RSA is a hashing algorithm used for verifying message integrity in network communications

Answer : B
Explanation: RSA (Rivest–Shamir–Adleman, 1977) is the most widely used public-key cryptosystem. Mathematical basis: multiplying two large primes p and q to get n = p×q is easy. Given only n, factoring it back to p and q is computationally infeasible for large primes. Key generation: choose large primes p, q. Compute n = p×q (modulus). Compute φ(n) = (p-1)(q-1). Choose e such that gcd(e, φ(n)) = 1 (public exponent, typically 65537). Compute d = e⁻¹ mod φ(n) (private exponent). Public key: (e, n), Private key: (d, n). Encryption: C = Mᵉ mod n. Decryption: M = Cᵈ mod n. Key sizes: RSA-2048 and RSA-4096 are standard (RSA-1024 is no longer secure). Use cases: key exchange in TLS/HTTPS, digital signatures (SSL certificates, code signing, email signing), and encrypting small payloads. Limitation: RSA is much slower than AES — in practice, RSA encrypts the AES session key (hybrid encryption), and AES encrypts the actual data.

33. What is a cryptographic hash function and what are its key properties?

  1. A hash function is a reversible encryption algorithm that can recover original data from the hash
  2. A cryptographic hash function is a one-way function that maps arbitrary-size input to a fixed-size output (digest) — with properties of preimage resistance, second preimage resistance, and collision resistance — ensuring data integrity verification
  3. A hash function is a key generation algorithm that creates symmetric keys from passwords
  4. Hash functions are only used for storing passwords and have no other cryptographic applications

Answer : B
Explanation: A cryptographic hash function H(m) takes any input m and produces a fixed-size digest. Key properties: Pre-image Resistance (One-way): given hash h, it is computationally infeasible to find m such that H(m) = h. Makes passwords unrecoverable from their hashes. Second Pre-image Resistance: given m₁ and H(m₁), it is infeasible to find m₂ ≠ m₁ such that H(m₁) = H(m₂). Collision Resistance: infeasible to find any two different inputs m₁ ≠ m₂ with H(m₁) = H(m₂). Avalanche Effect: a small change in input produces a completely different hash. Deterministic: same input always produces the same hash. Common algorithms: MD5 (128-bit, broken for security — only use for checksums). SHA-1 (160-bit, deprecated). SHA-256 (256-bit, current standard). SHA-512 (512-bit, high security). Applications: password storage (with salt and bcrypt/Argon2), data integrity verification, digital signatures, blockchain (Bitcoin uses SHA-256), Message Authentication Codes (HMAC).

34. What is a digital signature and how does it work?

  1. A digital signature is an electronic image of a handwritten signature scanned into a document
  2. A digital signature is a cryptographic mechanism where the sender hashes the message and encrypts the hash with their private key — the recipient decrypts using the sender’s public key and compares hashes to verify authenticity, integrity, and non-repudiation
  3. A digital signature encrypts the entire message content using the sender’s public key for security
  4. Digital signatures use symmetric keys — the same key signs and verifies the signature

Answer : B
Explanation: Digital signatures provide three security services: Authentication (message comes from who claimed), Integrity (message was not altered), Non-repudiation (sender cannot deny sending it). Process: Signing: sender computes H(message) using SHA-256. Encrypts hash with sender’s private key → Digital Signature. Sends (message + signature). Verification: recipient decrypts signature with sender’s public key → recovers hash. Independently computes H(message). If both hashes match → signature valid. Note: only the hash is signed (not the full message) because asymmetric encryption is slow. Digital signatures ≠ message encryption (message is still in plaintext unless separately encrypted). Algorithms: RSA-PSS, DSA (Digital Signature Algorithm), ECDSA (Elliptic Curve DSA — used in Bitcoin, TLS). Standards: FIPS 186 (Digital Signature Standard). Applications: SSL/TLS certificates, code signing (verify software authenticity), email signing (S/MIME, PGP), PDF document signing, blockchain transactions.

35. What is the difference between SHA-1, SHA-256, and MD5 hash algorithms?

  1. SHA-1 is the strongest; MD5 is the weakest; SHA-256 is only used for database encryption
  2. MD5 produces 128-bit digests (broken — collision attacks found); SHA-1 produces 160-bit digests (deprecated — theoretically broken); SHA-256 (SHA-2 family) produces 256-bit digests and is the current secure standard
  3. All three algorithms produce identical output lengths and differ only in processing speed
  4. MD5 is the newest standard; SHA-256 is an older algorithm being phased out

Answer : B
Explanation: Hash algorithm comparison: MD5 (Message Digest 5, 1992): 128-bit digest. Produces 32 hex characters. Broken: collision attacks found in 2004. Identical MD5 hashes created for different files. Do NOT use for security. Still used for non-security checksums (verifying file downloads where collision attacks are irrelevant). SHA-1 (Secure Hash Algorithm 1, 1995): 160-bit digest. 40 hex characters. Deprecated: Google demonstrated collision in 2017 (SHAttered attack). No longer accepted for SSL certificates or code signing. SHA-256 (SHA-2 family, 2001): 256-bit digest. 64 hex characters. Currently secure. Used in TLS 1.3, Bitcoin, AWS, Git commits, HTTPS certificates. SHA-512: 512-bit digest. Maximum security. SHA-3 (Keccak, 2015): completely different design from SHA-2 (sponge construction). Alternative to SHA-2 if SHA-2 were broken. Password hashing: never use raw SHA-256 for passwords (too fast — enables brute force). Use bcrypt, scrypt, or Argon2 (designed to be deliberately slow).

36. What is the Diffie-Hellman key exchange protocol and what problem does it solve?

  1. Diffie-Hellman is an encryption algorithm that secures messages sent over public networks
  2. Diffie-Hellman is a key exchange protocol that allows two parties to establish a shared secret key over an insecure channel without ever transmitting the key itself — solving the key distribution problem using discrete logarithm mathematics
  3. Diffie-Hellman is a digital signature algorithm used for authenticating users in SSL/TLS
  4. Diffie-Hellman replaces both symmetric and asymmetric encryption in modern secure protocols

Answer : B
Explanation: The Diffie-Hellman (DH) key exchange, invented in 1976 by Whitfield Diffie and Martin Hellman, was the first public key protocol. Problem solved: how can two parties who have never met create a shared secret over an insecure (eavesdropped) channel? Mathematical basis: discrete logarithm problem — given gˣ mod p, finding x is computationally infeasible for large p. Process: both agree on public parameters: prime p and generator g. Alice chooses secret a, computes A = gᵃ mod p, sends A to Bob. Bob chooses secret b, computes B = gᵇ mod p, sends B to Alice. Alice computes shared secret: K = Bᵃ mod p = gᵃᵇ mod p. Bob computes: K = Aᵇ mod p = gᵃᵇ mod p. Both arrive at the same K without ever transmitting it! Weakness: vulnerable to man-in-the-middle attack if parties are not authenticated (Q25 on your site). DHE (Ephemeral DH): new keys generated for each session — provides Perfect Forward Secrecy (PFS). ECDH (Elliptic Curve DH): uses elliptic curves for smaller key sizes with equivalent security. Used in TLS 1.3 exclusively.

37. What is SSL/TLS and how does the TLS handshake work?

  1. SSL and TLS are identical protocols — they are just different names for the same technology
  2. SSL (now replaced by TLS) provides encrypted communication over the internet — the TLS handshake establishes a secure session by negotiating protocol version and cipher suite, authenticating the server via certificate, and establishing a shared session key using asymmetric cryptography
  3. TLS only encrypts data in transit — it provides no authentication of the communicating parties
  4. SSL/TLS only works with HTTP and cannot be applied to other protocols like SMTP or FTP

Answer : B
Explanation: TLS (Transport Layer Security) evolved from Netscape’s SSL (now deprecated). TLS versions: SSL 2.0/3.0 (broken), TLS 1.0/1.1 (deprecated), TLS 1.2 (widely used), TLS 1.3 (current standard — faster, stronger). TLS 1.3 Handshake (simplified): Client Hello: client sends supported TLS version, cipher suites, random bytes. Server Hello: server selects cipher suite, sends its digital certificate (containing public key). Key Exchange: server sends key exchange parameters (ECDHE). Both parties independently compute the same session key (using ECDHE). Finished: both verify handshake integrity. Application data flows encrypted with AES (session key). What TLS provides: Confidentiality (AES encryption). Authentication (server’s certificate verifies identity). Integrity (HMAC prevents tampering). TLS protects: HTTPS (web), SMTPS (email), FTPS (file transfer), IMAPS (email retrieval). HTTPS: HTTP over TLS. The padlock icon indicates valid TLS certificate. TLS 1.3 improvements: eliminates RSA key exchange (only ECDHE), removes weak cipher suites, 1-RTT handshake (vs 2-RTT in TLS 1.2), 0-RTT resumption for returning clients.

38. What is Public Key Infrastructure (PKI) and what are its components?

  1. PKI is a software framework for managing private encryption keys within a single organization
  2. PKI is a framework of policies, procedures, hardware, software, and people to create, manage, distribute, use, store, and revoke digital certificates — enabling trust in public key cryptography across the internet
  3. PKI is a physical infrastructure of secure servers that store users’ private keys on their behalf
  4. PKI is an authentication protocol that verifies user identities through biometric scanning

Answer : B
Explanation: PKI (Public Key Infrastructure) solves the public key authentication problem: how do you know a public key actually belongs to whom it claims? PKI components: Certificate Authority (CA): trusted third party that issues digital certificates. Binds a public key to an identity (person, organization, server). Root CA and Intermediate CAs form a trust chain. Examples: DigiCert, Let’s Encrypt, Comodo, Symantec. Registration Authority (RA): verifies identity before CA issues a certificate. Certificate: X.509 format containing: subject (identity), public key, issuer (CA), validity period, serial number, CA’s digital signature. Certificate Revocation: CRL (Certificate Revocation List) — list of revoked certificates. OCSP (Online Certificate Status Protocol) — real-time revocation check. Certificate Repository: stores and distributes certificates. Key Recovery: archived private keys for legal/recovery purposes. Trust chain: browser trusts Root CA. Root CA signs Intermediate CA certificate. Intermediate CA signs server certificate. Browser verifies chain of trust to Root CA. EV (Extended Validation) certificates: rigorous identity verification — green bar in browsers (now just padlock). Let’s Encrypt provides free DV (Domain Validation) certificates — made HTTPS ubiquitous.

39. What is a firewall and what are its main types?

  1. A firewall is an antivirus program that detects and removes malware from computer systems
  2. A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing network traffic based on predetermined security rules — with types including packet filter, stateful inspection, application layer (proxy), and next-generation firewalls
  3. A firewall is a physical barrier installed in data centers to prevent unauthorized physical access
  4. A firewall only protects against external attacks and cannot monitor internal network traffic

Answer : B
Explanation: Firewalls are the first line of network defense. Types: Packet Filter Firewall (1st generation): examines individual packets based on source/destination IP, port, protocol. Stateless — each packet evaluated independently. Fast but limited — cannot track connection state. Stateful Inspection Firewall (2nd generation): tracks the state of active connections (SYN, SYN-ACK, ACK). Allows only packets belonging to established connections. Standard in modern networks. Application Layer Firewall (Proxy/3rd generation): operates at the application layer (Layer 7). Inspects actual content of HTTP, FTP, DNS traffic. Deep Packet Inspection (DPI). Can detect application-level attacks. Next-Generation Firewall (NGFW): combines stateful + application-layer + IPS + user identity awareness. Identifies applications regardless of port (e.g., detects BitTorrent on port 80). Examples: Palo Alto, Fortinet, Cisco Firepower. Web Application Firewall (WAF): protects web applications from SQL injection, XSS, CSRF. Operates at Layer 7. Examples: AWS WAF, Cloudflare WAF. Firewall rules: allow/deny traffic based on ACLs (Access Control Lists). Default deny policy: block everything, explicitly allow what’s needed.

40. What is a VPN (Virtual Private Network) and what cryptographic techniques does it use?

  1. A VPN makes internet connections faster by routing traffic through high-speed servers
  2. A VPN creates an encrypted tunnel over a public network (internet) that allows secure private communication — using tunneling protocols (IPsec, OpenVPN, WireGuard) with AES encryption and TLS/certificate-based authentication to protect data in transit
  3. A VPN is only used to bypass geographic content restrictions and has no security benefits
  4. VPNs store all user data encrypted on a central server for later retrieval by authorized users

Answer : B
Explanation: A VPN extends a private network across a public network, enabling secure communication. How it works: VPN client encrypts traffic before sending → sends through tunnel to VPN server → server decrypts and forwards to destination. To destination, traffic appears to originate from VPN server, not client. VPN protocols: IPsec (Internet Protocol Security): works at network layer (Layer 3). Used for site-to-site VPNs (branch offices). Two modes: Transport (encrypts payload only), Tunnel (encrypts entire packet). Uses AES + HMAC-SHA2. OpenVPN: uses TLS for key exchange, AES for data. Open-source, highly configurable. WireGuard (modern): uses state-of-the-art cryptography (ChaCha20, Curve25519, BLAKE2). Fastest VPN protocol, minimal code base. TLS-based VPNs: SSTP, L2TP. IKEv2/IPsec: commonly used on mobile devices. Enterprise uses: remote access for employees, connecting branch offices, accessing internal resources. Consumer uses: privacy, bypassing geographic restrictions. Perfect Forward Secrecy: WireGuard and modern OpenVPN configurations generate new session keys for each session — past traffic stays secure even if long-term keys are compromised.

Pages: 1 2 3 4 5 6 7 8 9 10