Cryptography and Network Security MCQ Questions And Answers

Cryptography and Network Security MCQ Questions And Answers

51. What is a buffer overflow attack and how does it relate to network security?

  1. A buffer overflow attack overwhelms a network buffer causing temporary bandwidth congestion
  2. A buffer overflow attack exploits programs that fail to validate input length — writing data beyond a buffer’s boundary overwrites adjacent memory, potentially allowing attackers to execute arbitrary code, escalate privileges, or crash the system
  3. Buffer overflow only affects database systems and has no impact on network security
  4. Buffer overflow attacks are prevented entirely by using the latest operating system version

Answer : B
Explanation: Buffer Overflow is one of the oldest and most devastating software vulnerabilities. How it works: program allocates a fixed-size buffer (e.g., 100 bytes for user input). Program does not check input length. Attacker sends 200 bytes of input. Extra 100 bytes overwrite adjacent memory: return address, function pointers, other variables. Attacker crafts input so the overwritten return address points to their malicious code (shellcode). Impact: remote code execution, privilege escalation, system crashes. Famous examples: Morris Worm (1988) exploited fingerd buffer overflow. Blaster/CodeRed exploited Windows buffer overflows. Modern exploits still use variations. Prevention: Input validation: always check and limit input length (most important). Safe functions: use strncpy() instead of strcpy() in C, bounds-checking. Memory-Safe Languages: Java, Python, Rust — automatic bounds checking (no manual memory management = no buffer overflows). Address Space Layout Randomization (ASLR): randomize memory addresses — attacker doesn’t know where to jump. Stack canaries: place a random value before return address — if overwritten, program detects attack. Non-Executable (NX) stack: prevent code execution from stack memory. Stack Smashing Protector: GCC/compiler flag (-fstack-protector). Modern exploit mitigations (ASLR + DEP + Stack canaries) make buffer overflows much harder but not impossible to exploit.

52. What is the One-Time Pad (OTP) and why is it considered theoretically unbreakable?

  1. OTP is a smartphone-based two-factor authentication system using time-based codes
  2. A One-Time Pad is a cipher that XORs plaintext with a truly random key the same length as the message, used only once — it is information-theoretically (unconditionally) secure, meaning even an attacker with unlimited computing power cannot break it without knowing the key
  3. OTP is unbreakable because it uses AES-256 encryption with multiple rounds of processing
  4. The One-Time Pad is only secure if used twice — using it once makes it vulnerable to cryptanalysis

Answer : B
Explanation: The One-Time Pad (OTP), formalized by Claude Shannon in 1949, is the only theoretically unbreakable encryption scheme. How it works: Key must be: truly random, same length as the message, used only once, kept completely secret. Encryption: C = P XOR K (ciphertext = plaintext XOR key). Decryption: P = C XOR K. Why unbreakable: for every possible plaintext P, there exists a key K such that C = P XOR K. Without the key, every plaintext is equally likely. An attacker with unlimited computing power cannot determine which plaintext is correct — all are equally probable. Perfect secrecy (Shannon’s theorem). Practical problems: Key management: the key must be as long as the message → for large data, key management is impractical. True randomness: pseudo-random number generators are NOT sufficient — must be truly random. Key distribution: how do you securely share the key? (The same problem symmetric encryption has). Never reuse: reusing the key breaks security (Vernam two-time pad attack). Historical use: Cold War “hotline” between US/USSR used OTP. Intelligence agencies for highest-security communications. Modern alternatives: For practical security (not information-theoretic perfection), AES-256 provides sufficient security against all known attacks including quantum computing (with 256-bit keys).

53. What is the role of a nonce in cryptographic protocols?

  1. A nonce is a type of digital signature that verifies the sender’s identity in a message
  2. A nonce (Number Used Once) is a random or pseudo-random value used only once in a cryptographic communication — preventing replay attacks, ensuring freshness of messages, and as initialization vectors in encryption modes
  3. A nonce is the secret private key used by a Certificate Authority to sign digital certificates
  4. A nonce is a performance optimization technique that reduces cryptographic computation time

Answer : B
Explanation: A Nonce (Number used ONCE) is fundamental in cryptography for ensuring uniqueness and freshness. Uses of nonces: Replay Attack Prevention: authentication challenge contains a random nonce → client includes nonce in signed response → server verifies nonce is fresh and unused. Session Uniqueness: TLS includes random nonces in Client Hello and Server Hello → ensures each session produces unique key material. IV (Initialization Vector): nonce used as the IV in block cipher modes (AES-CTR, AES-GCM). Ensures same plaintext encrypted twice produces different ciphertexts. AES-GCM nonce: should be unique for every encryption with the same key (12 bytes recommended). Blockchain (Bitcoin): miners search for a nonce value such that SHA-256(block + nonce) < target (proof of work). HTTPS TLS 1.3: uses a nonce-based AEAD (Authenticated Encryption with Associated Data) scheme. HMAC (Hash-based Message Authentication Code): combines message with a key and often a nonce. TLS random fields: 32-byte random values in ClientHello/ServerHello functionally serve as nonces for key derivation. Important: a nonce doesn't need to be secret — it just needs to be unique. Reusing a nonce with the same key in AES-GCM is catastrophic — reveals the keystream.

54. What is the difference between block ciphers and stream ciphers?

  1. Block ciphers are more secure than stream ciphers for all types of data encryption scenarios
  2. Block ciphers encrypt fixed-size blocks of data at a time (e.g., AES encrypts 128-bit blocks); stream ciphers encrypt data one bit or byte at a time using a keystream XORed with plaintext — each has different performance characteristics and suitable applications
  3. Stream ciphers use asymmetric keys; block ciphers exclusively use symmetric keys
  4. Block ciphers can only process text data; stream ciphers are needed for binary data encryption

Answer : B
Explanation: Block Ciphers: process data in fixed-size blocks. AES: 128-bit (16-byte) blocks. DES: 64-bit blocks. Padding required if data length is not a multiple of block size. Must use a mode of operation (ECB, CBC, CTR, GCM). AES-GCM is the gold standard for authenticated encryption. High latency for small data. Stream Ciphers: generate a continuous keystream, XOR with plaintext byte by byte or bit by bit. No padding needed. Examples: RC4 (deprecated — multiple vulnerabilities), ChaCha20 (modern, secure, used in TLS 1.3 and WireGuard), Salsa20. Low latency, good for real-time applications (streaming, voice). Modes of operation (block ciphers): ECB (Electronic Code Book): each block encrypted independently — identical plaintext blocks produce identical ciphertext. INSECURE — patterns visible (ECB penguin). CBC (Cipher Block Chaining): each block XORed with previous ciphertext before encryption. Needs IV. Sequential. CTR (Counter): converts block cipher into stream cipher — encrypt counter values, XOR with plaintext. Parallelizable. GCM (Galois/Counter Mode): CTR + authentication tag. Preferred for authenticated encryption (AEAD). AES-GCM: used in TLS 1.3, SSH, IPsec, WPA3. ChaCha20-Poly1305: stream cipher (ChaCha20) + authentication (Poly1305) — TLS 1.3 alternative, preferred on mobile devices.

55. What is a Message Authentication Code (MAC) and how does HMAC work?

  1. A MAC is a public key-based signature that verifies only the sender’s identity without integrity checking
  2. A MAC is a fixed-size authentication tag computed from a message and a shared secret key — verifying both message integrity (not tampered) and authenticity (from a party with the key); HMAC uses a hash function with the key to produce the tag
  3. MAC and HMAC are purely for performance optimization and have no security properties
  4. MACs require asymmetric keys and a trusted third party to function correctly

Answer : B
Explanation: A Message Authentication Code (MAC) provides both integrity and authenticity (but NOT non-repudiation — both parties share the same key). How MAC works: sender computes tag = MAC(key, message). Sends (message, tag). Receiver recomputes tag using the same key. If tags match → message is authentic and unaltered. HMAC (Hash-based MAC): HMAC(K, m) = H((K’ XOR opad) || H((K’ XOR ipad) || m)). Uses a hash function (SHA-256, SHA-512) with the key applied before and after the hash. HMAC-SHA256: produces a 256-bit authentication tag. HMAC-SHA256 is secure even if the underlying hash has length extension vulnerabilities. Properties: Unforgeability — attacker cannot create a valid MAC without the key. MAC vs Digital Signature: MAC uses symmetric key (shared secret) → faster, no PKI needed, but both parties can forge. Digital signature uses asymmetric keys (private key) → non-repudiation (only signer can create), but slower. Authenticated Encryption (AEAD): combines encryption and MAC in one operation. AES-GCM = AES encryption + GMAC authentication. Encrypt-then-MAC is the secure composition order (not MAC-then-Encrypt or Encrypt-and-MAC). Applications: TLS message authentication, API request authentication, JWT (JSON Web Token) verification, HTTPS cookie integrity.

56. What is SQL injection and how does cryptography help prevent it?

  1. SQL injection is a virus that inserts itself into SQL databases to corrupt their data
  2. SQL injection is an attack where malicious SQL code is inserted into input fields to manipulate database queries — cryptography alone does not prevent it; parameterized queries and input validation are the correct defenses, but encryption protects sensitive data if a breach occurs
  3. Encrypting the database entirely with AES-256 completely prevents all SQL injection attacks
  4. SQL injection only affects Oracle databases and not MySQL, PostgreSQL, or SQL Server

Answer : B
Explanation: SQL Injection remains in OWASP Top 10. Attack example: login query: SELECT * FROM users WHERE username=’$user’ AND password=’$pass’. Input: username = admin’– (comment symbol in SQL). Query becomes: SELECT * FROM users WHERE username=’admin’–‘ AND password=’anything’. Everything after — is a comment → logs in as admin without password. Defense (cryptography plays a supporting role): Parameterized queries (PreparedStatements): the PRIMARY defense. Input treated as data, not SQL code. Database encryption: if attackers do extract data via SQL injection, encryption (AES for data-at-rest) protects sensitive fields. But injection itself is not stopped by encryption. Password hashing: even after successful injection, extracted passwords are bcrypt hashes, not plaintext. Attackers need to crack them. Tokenization: replace sensitive values with tokens — credit card numbers replaced with random tokens; even extracted tokens are useless. Input validation and sanitization: secondary defense. Least privilege: database accounts with minimal permissions limit injection damage. WAF (Web Application Firewall): detects and blocks SQL injection patterns. Key insight: cryptography protects data confidentiality after a potential breach. The primary SQL injection defense is application-level: use parameterized queries, ORMs (Hibernate, SQLAlchemy), and stored procedures with proper input handling.

57. What is phishing and what cryptographic mechanisms help detect it?

  1. Phishing is a brute force attack that tries fishing for correct passwords systematically
  2. Phishing is a social engineering attack where attackers impersonate trusted entities to steal credentials, sensitive information, or install malware — digital certificates (PKI), DMARC/DKIM email authentication, and certificate transparency logs help detect fraudulent sites
  3. Phishing only works through email and cannot be conducted through websites or phone calls
  4. Cryptographic solutions alone completely eliminate phishing with no need for user awareness training

Answer : B
Explanation: Phishing tricks users into believing they are interacting with a trusted entity. Types: Email phishing: “Your account was compromised. Click here to verify.” → fake login page. Spear phishing: targeted attack on specific individuals (using personal details for credibility). Whaling: targeting executives (CEO fraud). Smishing: phishing via SMS. Vishing: voice phishing (phone calls). Website spoofing: clone of legitimate site at a lookalike domain (googIe.com). Cryptographic defenses: HTTPS/TLS certificates: legitimate sites have valid certificates. Browsers warn about invalid certificates. But attackers now get free Let’s Encrypt certs for phishing domains (green padlock ≠ safe). EV certificates provide higher assurance of site ownership. Certificate Transparency (CT) logs: all issued certificates are publicly logged. Security teams monitor CT logs for unauthorized certificates for their domains. DKIM (DomainKeys Identified Mail): email signed with sender’s private key. DMARC (Domain-based Message Authentication): policy specifying how to handle email failing DKIM/SPF checks. SPF (Sender Policy Framework): specifies authorized mail servers. Non-cryptographic: browser phishing filters (Google Safe Browsing), user training, MFA (if credentials stolen, MFA prevents access), password managers (autofill only on correct domain — won’t fill on fake sites), FIDO2/WebAuthn hardware keys (phishing resistant by design).

58. What is Two-Factor Authentication (2FA) and what types exist?

  1. 2FA means entering the same password twice to confirm the user’s identity during login
  2. Two-Factor Authentication requires users to provide two different types of credentials — something you know (password), something you have (phone/token), or something you are (biometric) — significantly reducing account compromise risk even if passwords are stolen
  3. 2FA is only effective against brute force attacks and provides no defense against phishing
  4. Two-Factor Authentication and Two-Step Verification are completely different security concepts

Answer : B
Explanation: 2FA (Two-Factor Authentication) adds a second verification layer. Authentication factors: Something you know: password, PIN, security questions. Something you have: smartphone, hardware token (YubiKey), smart card. Something you are: fingerprint, face recognition, retina scan (biometrics). Two-factor = two different factor categories. Two-step = same factor category twice (e.g., password + security question = NOT true 2FA). 2FA types (strongest to weakest): FIDO2/WebAuthn hardware keys (YubiKey, Passkey): phishing-resistant, no shared secrets transmitted. Cryptographic challenge-response. Most secure. TOTP (Time-based OTP) apps (Google Authenticator, Authy): generates 6-digit code every 30 seconds. Based on HMAC-SHA1 with time and shared secret. More secure than SMS. Not phishing-resistant (user can be tricked into entering on fake site). SMS OTP: one-time code sent via text. Vulnerable to SIM swapping attacks, SS7 network vulnerabilities. Weakest 2FA but still better than no 2FA. Email OTP: similar to SMS but through email. Push notifications (Duo, Okta): app prompts approval. Better UX. Vulnerable to MFA fatigue attacks (spam approvals). Biometrics: fingerprint, face recognition. Convenient. Biometric data cannot be changed if compromised. Passkeys (FIDO2): passwordless authentication standard — the future of authentication.

59. What is the Kerberos authentication protocol?

  1. Kerberos is a multi-factor authentication system developed by Apple for macOS security
  2. Kerberos is a network authentication protocol that uses tickets and a trusted third party (Key Distribution Center) to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner without sending passwords over the network
  3. Kerberos is a public-key infrastructure system used exclusively for web application authentication
  4. Kerberos is a firewall protocol that controls access to network resources based on user location

Answer : B
Explanation: Kerberos (from Greek mythology — the three-headed dog guarding Hades) is the authentication protocol used in Windows Active Directory and MIT Athena. Components: KDC (Key Distribution Center): trusted server with two parts: Authentication Server (AS) and Ticket Granting Server (TGS). Client. Service Server. Process: Client sends username to AS (no password). AS returns an encrypted challenge. Client uses password to decrypt → proves identity. AS issues TGT (Ticket Granting Ticket) — encrypted with TGS secret key. Client requests service ticket from TGS using TGT. TGS issues Service Ticket for specific service — encrypted with service’s secret key. Client presents Service Ticket to the Service Server. Service decrypts with its secret key → verifies client identity. Service provides access. Key features: Passwords never sent over network (only used locally to decrypt challenges). Mutual authentication: both client and server authenticate each other. Ticket-based: tickets have time limits (typically 8-10 hours) — reduces replay attack window. SSO (Single Sign-On): one login provides access to multiple services. Uses symmetric key cryptography (AES). Vulnerabilities: Kerberoasting (attacking service accounts), Golden Ticket attacks (compromising KDC), Pass-the-Ticket attacks. Used by: Windows Active Directory, Linux with SSSD, MIT Kerberos.

60. What is cross-site scripting (XSS) and how does it relate to network security?

  1. XSS is a network monitoring technique for tracking user activity across different websites
  2. XSS (Cross-Site Scripting) is a web security attack where malicious scripts are injected into web pages viewed by other users — allowing attackers to steal session cookies, redirect users, deface pages, or perform actions as the victim
  3. XSS only affects the attacker’s own browser and cannot affect other users of a website
  4. XSS attacks are prevented entirely by using HTTPS encryption for all web communications

Answer : B
Explanation: XSS attacks inject malicious scripts into trusted websites, executing in victims’ browsers. Types: Reflected XSS: malicious script in URL parameter → server reflects it in response → executes in victim’s browser. Example: https://site.com/search?q=<script>alert(‘XSS’)</script>. Stored XSS (Persistent): script stored in database (e.g., comment, profile). Every user who views the content executes the script. Most dangerous. DOM-based XSS: script manipulates DOM client-side without server involvement. Attack impact: Session hijacking: document.cookie theft → account takeover. Credential harvesting: redirect to fake login page. Keylogging: capture all keystrokes. Malware distribution: drive-by download. Defacement. Prevention: Output Encoding: encode special characters (< → &lt;) before rendering in HTML. CSP (Content Security Policy): HTTP header that restricts which scripts can execute. Prevents inline scripts and scripts from unknown domains. HttpOnly cookie flag: prevents JavaScript access to session cookies (defeats session theft). X-XSS-Protection header (legacy browsers). Input Validation: sanitize user input (remove or escape HTML tags). Use security libraries (DOMPurify for sanitizing HTML). CSP is the most powerful modern defense — even if XSS injection succeeds, CSP prevents the injected script from executing if it violates the policy.

Pages: 1 2 3 4 5 6 7 8 9 10