Cryptography and Network Security MCQ Questions And Answers

Cryptography and Network Security MCQ Questions And Answers

61. What is perfect forward secrecy (PFS) in cryptography?

  1. PFS means that a cryptographic system will remain secure forever regardless of future advances
  2. Perfect Forward Secrecy ensures that session keys are not compromised even if the server’s long-term private key is later compromised — achieved by generating new ephemeral key pairs for each session using Diffie-Hellman, so past sessions cannot be decrypted
  3. PFS is a backup encryption technique that perfectly forwards encrypted data to a secondary server
  4. Perfect Forward Secrecy is only relevant for military-grade encryption and not commercial applications

Answer : B
Explanation: Perfect Forward Secrecy (PFS) addresses a critical threat: “collect now, decrypt later.” Without PFS: attacker records all encrypted traffic (even if unreadable now). Years later, if the server’s private key is stolen or cracked, attacker decrypts ALL historically collected traffic. With PFS: each TLS session uses an ephemeral Diffie-Hellman key exchange (ECDHE). Session keys are generated freshly from temporary (ephemeral) keys. Temporary keys are deleted immediately after the session. Compromising the server’s long-term private key does not reveal past session keys. Attacker can only break sessions where they are actively present with the key. Implementation: TLS 1.3 mandates PFS — only allows ECDHE key exchange (RSA key exchange removed). TLS 1.2 with DHE/ECDHE cipher suites provides PFS. Cipher suites with PFS: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (E = ephemeral). Non-PFS cipher suites (RSA key exchange): TLS_RSA_WITH_AES_256_GCM_SHA384 — avoid. Practical importance: Snowden revelations: NSA collected encrypted traffic. PFS-protected traffic remains secure even against government archiving. Why TLS 1.3 is important: mandating ECDHE as the only key exchange makes PFS universal.

62. What is HTTPS and how does it differ from HTTP?

  1. HTTPS is just a faster version of HTTP with compression — it provides no additional security
  2. HTTPS (HTTP Secure) is HTTP over TLS — it provides encryption (confidentiality), server authentication via digital certificates, and data integrity for all communication between browser and web server, unlike plain HTTP which transmits everything in cleartext
  3. HTTPS encrypts only the URL and headers while the page content remains in plain HTTP format
  4. HTTPS only works on port 443 and cannot be configured to use any other port number

Answer : B
Explanation: HTTPS = HTTP + TLS. What HTTPS protects: Confidentiality: all HTTP traffic (headers, cookies, request bodies, responses) encrypted. Prevents eavesdropping on public Wi-Fi. Authentication: TLS certificate verifies the server is who it claims to be. Prevents MITM impersonation. Integrity: TLS MAC prevents tampering with content in transit. Protects against content injection attacks. HTTP vs HTTPS: HTTP port: 80. HTTPS port: 443. HTTP: everything visible to anyone on the network. HTTPS: everything encrypted. Getting HTTPS: purchase or obtain a TLS certificate from a CA. Configure the web server to use it. Let’s Encrypt: free automated DV certificates via ACME protocol. Certbot automates renewal. Changed HTTPS adoption from ~40% to near-universal. Important clarifications: HTTPS protects data IN TRANSIT. Does NOT protect data on the server. Does NOT protect against server-side vulnerabilities (SQL injection, XSS). “Secure” padlock means the connection is encrypted, NOT that the site is trustworthy. Phishing sites now use HTTPS too. HSTS (HTTP Strict Transport Security): forces browsers to always use HTTPS. Prevents SSL stripping attacks. HSTS Preload list: browsers ship with HSTS sites hard-coded. Google ranks HTTPS sites higher in search results — additional incentive for adoption.

63. What is an IPsec and what are its two main modes?

  1. IPsec is an application-layer security protocol that only protects HTTP and HTTPS traffic
  2. IPsec (Internet Protocol Security) is a network-layer (Layer 3) protocol suite that authenticates and encrypts IP packets — with Transport mode (encrypts only the payload, keeping the IP header intact) and Tunnel mode (encrypts the entire original IP packet and encapsulates it in a new packet)
  3. IPsec is only available on Windows systems and cannot be used on Linux or macOS
  4. IPsec and SSL/TLS are identical — they just operate at different OSI layers with the same security properties

Answer : B
Explanation: IPsec is a standard framework for securing IP communications. Two protocols: AH (Authentication Header): provides authentication and integrity but NOT confidentiality (no encryption). Detects tampering but doesn’t encrypt. Less common today. ESP (Encapsulating Security Payload): provides encryption (AES), authentication, and integrity. The most used IPsec protocol. Two modes: Transport Mode: encrypts only the IP payload (TCP/UDP data). Original IP header remains in clear. Used for end-to-end communication between two hosts. Path: Host A → [IP header | encrypted payload] → Host B. Tunnel Mode: encrypts the ENTIRE original IP packet. New IP header added with VPN gateway addresses. Original IP header hidden — provides location privacy. Used for site-to-site VPNs (gateway-to-gateway) and remote access VPNs. Path: Host → [New IP header | encrypted (original IP header + payload)] → VPN Gateway → Destination. IKE (Internet Key Exchange): used to negotiate IPsec parameters and exchange keys. IKEv2: modern version — faster, more reliable, supports MOBIKE (roaming between networks). IPsec use cases: Site-to-site VPN (branch office connectivity). Remote access VPN (replace with WireGuard in modern deployments). Secure mobile worker connectivity. IKEv2/IPsec is the recommended VPN protocol for enterprise mobile devices.

64. What is social engineering in the context of cybersecurity?

  1. Social engineering is a network topology technique used for large-scale system deployments
  2. Social engineering is a cyberattack technique that exploits human psychology rather than technical vulnerabilities — manipulating people into revealing confidential information, granting access, or taking actions that compromise security
  3. Social engineering only works against non-technical users and cannot affect IT security professionals
  4. Social engineering attacks are all conducted remotely with no direct human interaction required

Answer : B
Explanation: Social Engineering exploits the weakest link in security: humans. “The only secure computer is one that’s unplugged” — but a human can be tricked into plugging it back in. Common techniques: Phishing: deceptive emails impersonating trusted entities. Pretexting: creating a fabricated scenario to extract information. Example: “I’m from IT support, what’s your password to fix your account?” Baiting: leaving infected USB drives in parking lots hoping employees plug them in. Quid Pro Quo: “I’ll fix your computer problem if you give me your login credentials.” Tailgating (Piggybacking): physically following authorized personnel through secure doors. Vishing: phone-based social engineering. CEO Fraud (BEC): impersonating executives to authorize wire transfers. Famous attacks: RSA SecurID breach 2011: phishing email with Excel attachment. Sony Pictures 2014: spear phishing led to massive breach. Twitter 2020 hack: employees socially engineered into providing admin credentials. Prevention: Security awareness training — the most effective defense. Verification procedures: always verify identity through independent channel. Need-to-know policies. Clear incident reporting procedures. Two-person integrity for sensitive operations. Physical security: badge access, visitor escorts. Cryptographic solutions (2FA, hardware tokens) reduce damage when social engineering succeeds but cannot prevent the human manipulation itself.

65. What is the difference between authentication, authorization, and access control?

  1. Authentication and authorization are identical concepts with different names in different organizations
  2. Authentication verifies “who are you?” (identity verification); authorization determines “what are you allowed to do?” (permission enforcement); access control is the overall system implementing these mechanisms to protect resources
  3. Authorization is performed before authentication in modern security systems for efficiency
  4. Access control only applies to physical doors and physical resources, not digital systems

Answer : B
Explanation: Authentication (AuthN): verifying a claimed identity. Mechanisms: passwords, biometrics, certificates, tokens (2FA). “I am Alice” → system verifies it really is Alice. Authentication methods: Something you know (password), Something you have (OTP), Something you are (biometric), Somewhere you are (IP geolocation), Something you do (behavioral). Authorization (AuthZ): determines what an authenticated entity is permitted to do. Always follows authentication. Mechanisms: RBAC (Role-Based Access Control): permissions assigned to roles; users assigned roles. Admin role → full access, User role → read-only access. ABAC (Attribute-Based Access Control): based on attributes (user department, time, resource classification). MAC (Mandatory Access Control): security labels on resources and users (military — Top Secret, Secret, Confidential). DAC (Discretionary Access Control): resource owner controls permissions (Unix file permissions). Access Control: the comprehensive security mechanism enforcing authentication + authorization. AAA framework: Authentication, Authorization, Accounting. Accounting: logging who did what, when. RADIUS, TACACS+: network access control protocols implementing AAA. OAuth 2.0: authorization framework (NOT authentication) — allows third-party access to resources. OpenID Connect (OIDC): adds authentication layer on top of OAuth 2.0. LDAP + Kerberos: enterprise authentication backend.

66. What is a certificate revocation and what methods are used?

  1. Certificate revocation means deleting a certificate from the device that uses it for SSL connections
  2. Certificate revocation is the process of invalidating a digital certificate before its scheduled expiry — when the private key is compromised or the certificate is no longer trusted — using CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol)
  3. Certificate revocation automatically updates all devices that use the certificate without manual action
  4. Certificates cannot be revoked — they must simply expire and be replaced after their validity period

Answer : B
Explanation: Certificate revocation is needed when: private key is compromised, certificate was issued incorrectly, organization changed, certificate holder violated CA policies. Methods: CRL (Certificate Revocation List): CA periodically publishes a signed list of revoked certificate serial numbers. Browsers download the CRL and check if the certificate is listed. Problems: CRLs can be large (MB+), downloaded infrequently, stale data (certificates may be revoked but CRL not yet updated). OCSP (Online Certificate Status Protocol): real-time single certificate status check. Browser queries OCSP responder with certificate serial number. Gets signed “good” or “revoked” response. Problems: privacy (OCSP tells CA every site you visit), availability (OCSP server downtime), browser may fail-open (accept certificate if OCSP unavailable). OCSP Stapling: server periodically fetches and caches its own OCSP response. Staples (attaches) the signed OCSP response to the TLS handshake. Browser verifies the stapled response — no separate OCSP query needed. Eliminates privacy concern and availability dependency. Certificate Transparency (CT) logs: all certificates publicly logged. Enables detection of misissued certificates. Real-world failure: DigiNotar 2011 — CA compromised, fraudulent certificates issued for *.google.com. Major push for CT logs after this incident. Let’s Encrypt: short-lived certificates (90 days) — revocation less critical as certificates expire quickly.

67. What is end-to-end encryption (E2EE) and how is it different from transport encryption?

  1. E2EE encrypts data twice — once on the client and once on the server for maximum security
  2. End-to-end encryption ensures only the communicating parties can read messages — even the service provider cannot decrypt the content; transport encryption (TLS) only encrypts data in transit and the service provider can decrypt and read messages on their servers
  3. E2EE is the same as HTTPS — all web traffic using TLS has end-to-end encryption
  4. End-to-end encryption is only possible between two devices on the same local network

Answer : B
Explanation: Transport Encryption (TLS/HTTPS): encrypts data between user’s device and the service’s server. Service provider CAN decrypt and read messages on their servers. Example: WhatsApp WITHOUT E2EE — Meta can read all messages. Good for: protecting against eavesdroppers on the network. Not protecting from the service provider itself. End-to-End Encryption (E2EE): data encrypted on sender’s device with recipient’s public key. Only decrypted on recipient’s device with their private key. Service provider stores and transmits only encrypted data — CANNOT read it. Even server breach doesn’t expose message content. How it works: Signal Protocol (used by Signal, WhatsApp): combines asymmetric keys (Curve25519 X3DH) + symmetric keys (AES) + forward secrecy (Double Ratchet algorithm). New encryption keys generated for each message. Applications with E2EE: Signal (best privacy), WhatsApp (Signal Protocol, but metadata visible to Meta), iMessage (Apple-to-Apple), Telegram (Secret Chats only — regular chats NOT E2EE), ProtonMail, Tutanota. E2EE debate: governments push for “backdoors” to enable lawful access. Security experts argue backdoors weaken security for everyone. E2EE protects journalists, dissidents, abuse survivors, and ordinary users from unauthorized surveillance.

68. What is the difference between WEP, WPA, WPA2, and WPA3 in wireless security?

  1. All four protocols are equally secure — newer versions only add performance improvements
  2. WEP (broken, retired) → WPA (TKIP, improved but still flawed) → WPA2 (AES-CCMP, current standard, secure) → WPA3 (SAE, strongest — prevents offline dictionary attacks, mandatory forward secrecy, protects open networks)
  3. WPA3 is only available on the latest 5G networks and cannot be used on standard Wi-Fi
  4. WPA2 and WPA3 use asymmetric encryption while WEP and WPA use symmetric encryption

Answer : B
Explanation: Wi-Fi security evolution: WEP (Wired Equivalent Privacy, 1997): uses RC4 stream cipher with 40/104-bit keys. Broken in 2001 — IV (Initialization Vector) reuse vulnerability. Can be cracked in minutes with freely available tools. Never use WEP. WPA (Wi-Fi Protected Access, 2003): emergency fix for WEP. Uses TKIP (Temporal Key Integrity Protocol) — RC4 with per-packet keys. Vulnerable to TKIP attacks — deprecated. WPA2 (2004): uses AES-CCMP (AES in Counter Mode with CBC-MAC Protocol) — strong encryption. PBKDF2 for password hashing (100,000 iterations). Vulnerable to offline dictionary attacks if password is weak (WPA2-PSK). KRACK attack (2017) — patched in firmware updates. Currently: still widely used and secure with strong passwords. WPA3 (2018): SAE (Simultaneous Authentication of Equals) replaces PSK handshake. Prevents offline dictionary attacks (Dragonfly handshake). Mandatory Perfect Forward Secrecy. OWE (Opportunistic Wireless Encryption): encrypts open networks (café Wi-Fi) without passwords. 192-bit security mode for enterprise. WPA3 Enterprise: 192-bit security mode with Suite B cryptography. Recommendation: use WPA3 where available. WPA2 with strong password (20+ characters) is still acceptable.

69. What is an ethical hacker and what is the difference between black hat, white hat, and grey hat hackers?

  1. White hat hackers are criminals; black hat hackers are cybersecurity professionals working legally
  2. White hat hackers (ethical hackers) test security with permission to find vulnerabilities before malicious attackers do; black hat hackers exploit systems illegally for personal gain; grey hat hackers find vulnerabilities without permission but typically disclose them rather than exploiting maliciously
  3. All hackers are criminals — the hat color only indicates the severity of their crimes
  4. Ethical hacking and penetration testing are different activities with no overlap in their techniques

Answer : B
Explanation: Hacker categories: White Hat (Ethical Hacker): security professional hired to find vulnerabilities before attackers do. Works with explicit written permission. Penetration testing, vulnerability assessment, red team exercises. Certifications: CEH (Certified Ethical Hacker), OSCP (Offensive Security Certified Professional), CISSP. Black Hat: exploits systems for malicious purposes: financial gain, espionage, disruption. Criminal activity. Grey Hat: operates in ethical gray area. May find and expose vulnerabilities without permission. Sometimes demands payment for disclosure (controversial). Ethical hacking phases (penetration testing methodology): Reconnaissance: gather information about the target (passive and active). Scanning: identify open ports, services, vulnerabilities. Gaining Access: exploit vulnerabilities to enter systems. Maintaining Access: establish persistence (simulating advanced persistent threats). Reporting: document findings and remediation recommendations. Rules of Engagement (ROE): defined scope, rules, and limitations before testing begins. Bug Bounty Programs: organizations invite ethical hackers to find and report vulnerabilities for financial rewards. Platforms: HackerOne, Bugcrowd, Synack. Companies: Google, Apple, Microsoft, Facebook all have bug bounty programs paying up to $1M+ for critical vulnerabilities. Responsible disclosure: report to vendor first, allow reasonable time to patch, then publish.

70. What is ransomware and what cryptographic techniques does it use?

  1. Ransomware is a type of firewall attack that blocks users from accessing the internet
  2. Ransomware is malware that encrypts the victim’s files using strong cryptography (typically RSA + AES) and demands payment for the decryption key — making files inaccessible without the attacker’s private key
  3. Ransomware only affects large corporations and government — personal computers are immune
  4. Ransomware is easily decrypted by antivirus software because it uses weak encryption algorithms

Answer : B
Explanation: Ransomware has become the dominant cybercrime business model. Cryptography used: Hybrid encryption model: Generate a random AES-256 session key. Encrypt all victim files with AES-256 (fast, strong). Encrypt the AES key with the attacker’s RSA-4096 public key. Delete the original AES key. Send the RSA-encrypted AES key to attacker. Attacker holds the RSA private key. Result: victim’s files are locked with mathematically unbreakable encryption. No way to decrypt without the attacker’s private key. Payment extortion: typically demands payment in cryptocurrency (Bitcoin, Monero) for anonymity. Decryption key provided (sometimes) upon payment. Notable ransomware: WannaCry (2017) — exploited NSA’s EternalBlue vulnerability. NotPetya (2017) — $10 billion damage, targeted Ukraine but spread globally. Colonial Pipeline (2021) — shut down 45% of US East Coast fuel supply. Prevention: Offline backups: the most effective defense — restore from backup without paying. Patch management: WannaCry exploited a months-old patched vulnerability. Endpoint protection: next-gen antivirus with behavioral analysis. Network segmentation: limit spread between systems. Employee training: most ransomware enters via phishing. MFA: prevents credential-based access. No general decryption tool exists for modern ransomware using proper cryptography — backup is the only reliable defense.

Pages: 1 2 3 4 5 6 7 8 9 10