Cryptography and Network Security MCQ Questions And Answers

Cryptography and Network Security MCQ Questions And Answers

41. What is the difference between a substitution cipher and a transposition cipher?

  1. Substitution ciphers are modern; transposition ciphers are only used in ancient history
  2. Substitution ciphers replace each character or group of characters with a different character (changing the symbols); transposition ciphers rearrange the positions of characters without changing the characters themselves (changing the order)
  3. Transposition ciphers are stronger than substitution ciphers for all types of secret messages
  4. Substitution ciphers work on bits; transposition ciphers only work on character-level data

Answer : B
Explanation: Classical ciphers form the foundation of modern cryptography: Substitution Ciphers: replace plaintext characters with ciphertext characters. Monoalphabetic: one fixed substitution alphabet. Caesar cipher: shift each letter by a fixed amount (e.g., A→D, B→E with shift 3). Vulnerable to frequency analysis (e stands out). Vigenère cipher: polyalphabetic — uses a keyword to vary shifts. Playfair cipher: digraph substitution. One-Time Pad: theoretically unbreakable if key is truly random, same length as message, and used once. Transposition Ciphers: rearrange character positions without changing the characters. Rail Fence cipher: write message diagonally across “rails,” read row by row. Columnar transposition: write in rows, read by columns in a key-defined order. Combined: modern block ciphers use both substitution (S-boxes) and permutation (transposition) in multiple rounds — this is called a substitution-permutation network (SPN). AES uses SPN: SubBytes (substitution) + ShiftRows/MixColumns (permutation). Combining both operations makes ciphers dramatically harder to break than either alone.

42. What is a man-in-the-middle (MITM) attack and how is it prevented?

  1. A MITM attack is when an attacker installs malware on the target’s computer remotely
  2. A MITM attack occurs when an attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly — prevented through mutual authentication using digital certificates (PKI), certificate pinning, and HSTS
  3. A MITM attack is only possible on wireless networks and cannot occur on wired connections
  4. MITM attacks are only a theoretical threat with no real-world practical implementations

Answer : B
Explanation: In a MITM attack, the attacker positions themselves between the two communicating parties: Alice ↔ Mallory (attacker) ↔ Bob. Alice thinks she’s talking to Bob; Bob thinks he’s talking to Alice. The attacker can read, modify, and inject messages. Attack vectors: ARP Poisoning: attacker sends fake ARP replies associating their MAC with the gateway’s IP — all traffic flows through attacker. DNS Spoofing: fake DNS responses redirect user to attacker-controlled server. SSL Stripping: downgrade HTTPS to HTTP. Rogue Wi-Fi hotspot: attacker creates a fake “Free Airport Wi-Fi.” SSL Certificates: the attacker’s server presents a fake certificate. Prevention: Digital certificates with PKI: browser verifies the server’s certificate chain back to a trusted CA. Certificate Pinning: application hard-codes expected certificate — rejects unexpected ones (used in banking apps). HSTS (HTTP Strict Transport Security): browser remembers to always use HTTPS — refuses plain HTTP. HSTS Preload: browsers ship with HSTS list — prevents initial HTTP connection. DNSSEC: digitally signed DNS records prevent DNS spoofing. Mutual TLS (mTLS): both client and server present certificates. 802.1X network authentication.

43. What is a brute force attack and what makes encryption resistant to it?

  1. A brute force attack uses physical force to break into a computer data center
  2. A brute force attack systematically tries every possible key combination until the correct one is found — encryption resists it through large key spaces (AES-256 has 2²⁵⁶ possible keys), making exhaustive search computationally infeasible within any practical time frame
  3. Brute force attacks only target password hashes and cannot be applied to encrypted files
  4. A brute force attack uses advanced mathematics to factor encryption keys without trying all combinations

Answer : B
Explanation: A Brute Force Attack tries every possible key or password until finding the correct one. Key space analysis: DES: 2⁵⁶ ≈ 72 quadrillion keys. 1999: EFF’s “Deep Crack” broke DES in 22 hours. AES-128: 2¹²⁸ keys. At 10¹² attempts/second: would take 10²⁰ years — longer than the age of the universe. AES-256: 2²⁵⁶ keys. Essentially impossible to brute force with current or foreseeable technology. Password attacks: Online brute force: try passwords against a live login system (rate-limited). Offline brute force: crack password hashes from a stolen database. Dictionary attack: try common words and variations first (faster than pure brute force). Rainbow table attack: precomputed hash-to-password lookups. Countermeasures: Account lockout (block after N failed attempts). Rate limiting. Salted hashes (salt defeats rainbow tables — each password hash is unique). Strong hashing (bcrypt, Argon2 — designed to be slow: 100ms per attempt vs. microseconds for SHA-256). Long, complex passwords (increases key space). Quantum computing threat: Grover’s algorithm reduces effective security by half — AES-128 becomes AES-64 equivalent security. AES-256 remains secure against quantum brute force.

44. What is steganography and how does it differ from cryptography?

  1. Steganography and cryptography are identical — both secure messages using mathematical algorithms
  2. Steganography hides the existence of a message by concealing it within another file (image, audio, video, text) — the message is invisible to observers; cryptography transforms a message to make it unreadable — the existence of communication is known but the content is protected
  3. Steganography is more secure than cryptography because it uses stronger mathematical transforms
  4. Steganography only works on text files and cannot be applied to images or audio files

Answer : B
Explanation: Steganography (from Greek: “covered writing”) hides the fact that a message exists. Cryptography hides the content of a message but not its existence. Key difference: with encrypted messages, an attacker knows a secret message was sent (just cannot read it). With steganography, the attacker doesn’t even know a message was sent. Techniques: LSB (Least Significant Bit) steganography: replace the least significant bits of image pixels with message bits. A 1024×1024 RGB image can hide ~390KB of data with virtually no visible change. Audio steganography: embed in audio samples. Video steganography: spread across video frames. Text steganography: encode in whitespace, capitalization, or word choices. Detection: steganalysis tools detect statistical anomalies in carrier files. Combination: using both cryptography AND steganography provides maximum security — even if the hidden message is detected, it is still encrypted. Applications: digital watermarking (copyright protection), covert communication, military intelligence, combating digital piracy, malware (some malware hides commands in images — “stego malware”). Modern example: news reports of intelligence agencies detecting steganographic messages in images posted on public websites.

45. What is a digital certificate and what information does an X.509 certificate contain?

  1. A digital certificate is a file that contains only the public key of the certificate owner
  2. A digital certificate (X.509 standard) is an electronically signed document issued by a Certificate Authority that binds a public key to an identity — containing subject name, public key, issuer, validity period, serial number, and the CA’s digital signature
  3. Digital certificates contain both public and private keys together for convenience in deployment
  4. Digital certificates are only used for websites and cannot be used for email or code signing

Answer : B
Explanation: An X.509 digital certificate (ITU-T standard) contains: Version: typically v3. Serial Number: unique identifier within the issuing CA. Signature Algorithm: algorithm used by CA to sign (SHA-256 with RSA). Issuer: the CA that issued the certificate (e.g., DigiCert SHA2 Secure Server CA). Validity Period: Not Before and Not After dates. Subject: the entity the certificate belongs to (CN=www.google.com, O=Google LLC, C=US). Subject Public Key Info: the public key and algorithm (RSA 2048-bit). Subject Alternative Names (SANs): additional domains/IPs the certificate covers. Key Usage: allowed uses (digital signature, key encipherment). Basic Constraints: is this a CA certificate? Certificate Policies: validation type (DV, OV, EV). CA’s Digital Signature: CA signs all the above — binding the identity to the public key. Certificate types: DV (Domain Validation): verifies domain ownership only. OV (Organization Validation): verifies organization identity. EV (Extended Validation): rigorous verification — highest trust. Wildcard certificates: *.example.com — covers all subdomains. Self-signed certificates: signed by the entity itself — not trusted by default (used in development/testing).

46. What is an Intrusion Detection System (IDS) and how does it differ from an IPS?

  1. IDS blocks malicious traffic in real time; IPS only monitors traffic without taking action
  2. An IDS (Intrusion Detection System) monitors network traffic and alerts on suspicious activity without blocking it; an IPS (Intrusion Prevention System) additionally takes active action to block detected threats in real time
  3. IDS is a hardware device only; IPS is implemented entirely in software with no hardware component
  4. IDS and IPS are identical systems — they differ only in the vendor’s marketing terminology

Answer : B
Explanation: IDS (Intrusion Detection System): monitors and analyzes network traffic or host activity. Detects suspicious patterns and generates alerts (logs, email, SIEM). Passive — does NOT block traffic. Risk: generates alerts that security team must act on (alert fatigue is common). Types: NIDS (Network IDS): monitors network traffic at strategic points. HIDS (Host IDS): monitors activity on a specific host (logs, file changes). IPS (Intrusion Prevention System): everything IDS does, plus actively blocks or drops malicious traffic. Inline deployment — sits in the traffic path. Can block IP addresses, drop packets, reset connections. Risk: may block legitimate traffic (false positives can cause outages). Detection methods: Signature-based: matches traffic against known attack patterns/signatures. Fast, accurate for known attacks. Cannot detect zero-day attacks. Anomaly-based: establishes baseline normal behavior. Alerts on statistical deviations. Can detect novel attacks. Higher false positive rate. The tradeoff: more sensitive = more false positives (normal traffic blocked). Less sensitive = more false negatives (attacks missed). Modern security: NGFW integrates IPS functionality. SIEM (Security Information and Event Management) correlates IDS/IPS alerts with other security data for context-aware threat detection.

47. What is the difference between symmetric and asymmetric encryption?

  1. Symmetric encryption is more secure than asymmetric encryption for all use cases
  2. Symmetric encryption uses the same key for encryption and decryption (fast, efficient — used for bulk data); asymmetric encryption uses a mathematically linked key pair — public key encrypts, private key decrypts (slow — used for key exchange and digital signatures)
  3. Asymmetric encryption can only be used for small messages under 256 bytes in length
  4. Symmetric encryption is only used in hardware devices; asymmetric is only used in software

Answer : B
Explanation: Symmetric Encryption: one key used for both encryption and decryption. Examples: AES, DES, 3DES, ChaCha20. Fast (software: ~10 GB/s with AES-NI hardware acceleration). Problem: key distribution — how to securely share the secret key with the recipient? Asymmetric Encryption: mathematically linked key pair. Anything encrypted with public key can only be decrypted with the corresponding private key. Examples: RSA, ECC (Elliptic Curve Cryptography). Slow (RSA: ~1000× slower than AES). Solves key distribution: public key can be openly shared. Private key never leaves the owner. Practical approach — Hybrid Encryption: use asymmetric to securely exchange a symmetric session key, then use symmetric for bulk data. Example (TLS): RSA or ECDHE (asymmetric) establishes session key → AES (symmetric) encrypts actual data. This is how HTTPS works — fast symmetric encryption for data, asymmetric only for key exchange. Comparison: Symmetric: speed → fast, key management → difficult (key distribution problem), key size → 128-256 bits. Asymmetric: speed → slow, key management → easier (public key freely shareable), key size → 2048-4096 bits RSA.

48. What is ARP Poisoning (ARP Spoofing) and how does it enable network attacks?

  1. ARP Poisoning is a database attack that corrupts DNS records with malicious IP addresses
  2. ARP Poisoning is a network attack where an attacker sends fake ARP (Address Resolution Protocol) replies associating their MAC address with a legitimate IP address — redirecting network traffic through the attacker’s machine to enable MITM attacks, session hijacking, or DoS
  3. ARP Poisoning is a physical attack that destroys network hardware using chemical agents
  4. ARP Poisoning only affects wireless networks and has no impact on wired Ethernet networks

Answer : B
Explanation: ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network. ARP has no authentication — any device can claim any IP. ARP Poisoning attack: attacker sends gratuitous ARP replies: “IP 192.168.1.1 (gateway) is at MAC AA:BB:CC:DD:EE:FF (attacker’s MAC).” Both victim and gateway update their ARP caches. Now all victim traffic flows: Victim → Attacker → Gateway. Attacker can: intercept and read all traffic (MITM). Modify traffic in transit. Capture credentials (username/passwords). Session hijacking. Launch DoS by dropping all packets. Detection: ARP cache inspection (static ARP entries, dynamic changes). Network monitoring tools (Wireshark, XArp). Countermeasures: Dynamic ARP Inspection (DAI): switch feature that validates ARP packets against DHCP snooping binding table. Static ARP entries for critical systems. VLANs: limit broadcast domains. 802.1X port authentication. Encrypted traffic: even if intercepted, TLS-encrypted traffic is unreadable. IPv6 uses NDP (Neighbor Discovery Protocol) instead of ARP — also vulnerable to similar attacks (NDP spoofing) but has better authentication options.

49. What is a denial of service (DoS) and distributed denial of service (DDoS) attack?

  1. DoS attacks only target database servers; DDoS attacks only target web servers
  2. A DoS attack overwhelms a target system with traffic or requests to make it unavailable to legitimate users; a DDoS attack uses thousands or millions of compromised machines (botnet) simultaneously — making it much harder to block as traffic comes from many sources
  3. DoS attacks only affect physical hardware; DDoS attacks target software and operating systems only
  4. DDoS attacks are illegal but DoS attacks are legal when targeting one’s own systems only

Answer : B
Explanation: DoS (Denial of Service): a single attacker floods the target with traffic/requests, exhausting resources (bandwidth, CPU, memory, connections). Simple to block by blacklisting the attacker’s IP. DDoS (Distributed DoS): attack traffic originates from thousands/millions of compromised devices (botnet). Impossible to block by IP — legitimate and attack traffic from everywhere. Large DDoS attacks exceed 1 Tbps. DDoS attack types: Volume-based: UDP flood, ICMP flood — saturate bandwidth. Protocol attacks: SYN flood (half-open connections exhaust server’s connection table), Ping of Death. Application layer attacks (Layer 7): HTTP flood — legitimate-looking requests. Slowloris — opens many connections and keeps them open. DNS amplification: attacker spoofs victim’s IP in DNS queries to open resolvers. DNS sends large responses to victim (amplification factor ~50×). Countermeasures: Rate limiting at network edge. ISP-level traffic scrubbing. Anycast routing (CloudFlare, Akamai absorb attack traffic). CDN (Content Delivery Network) distributes load. BGP blackholing (emergency: route attack traffic to null). Web Application Firewalls with bot detection. CAPTCHA challenges for suspected automated traffic. SYN cookies: cryptographic technique preventing SYN flood table exhaustion.

50. What is a replay attack and how is it prevented?

  1. A replay attack repeatedly plays the same audio recordings to confuse speech recognition systems
  2. A replay attack occurs when an attacker captures valid authentication data (login packets, tokens, authentication messages) and retransmits them later to gain unauthorized access — prevented using nonces, timestamps, and session tokens
  3. A replay attack is only possible on live video streams and cannot affect authentication systems
  4. Replay attacks are prevented by using stronger encryption algorithms with longer key sizes

Answer : B
Explanation: A Replay Attack captures and retransmits valid network packets without needing to understand or decrypt them. Example: Alice sends an authenticated payment message “Transfer $1000 to Bob.” Mallory captures this packet. Later, Mallory sends the exact same packet again → second $1000 transfer succeeds. This works even if the traffic is encrypted — Mallory replays the encrypted packet as-is. Prevention techniques: Nonce (Number Used Once): include a unique random value in each message. Server rejects repeated nonces. Timestamps: include a timestamp in the message. Server rejects messages older than a short window (typically 5 minutes). Sequence Numbers: each message has an incrementing sequence number. Server rejects out-of-order or duplicate numbers. Session Tokens: unique per-session tokens (JWTs with expiry). Short expiration: tokens expire quickly. Challenge-Response: server issues a random challenge; client must include it in response. Used in Kerberos, TLS, and WPA2. HTTPS with TLS inherently prevents replay attacks: TLS sequence numbers and session resumption prevent message replay. Kerberos: uses timestamps + nonces for mutual authentication.

Pages: 1 2 3 4 5 6 7 8 9 10