Cryptography and Network Security MCQ Questions And Answers

Cryptography and Network Security MCQ Questions And Answers

71. What is elliptic curve cryptography (ECC) and what advantages does it have over RSA?

  1. ECC uses the mathematical properties of elliptic shapes (ovals) to strengthen RSA encryption
  2. ECC is a public-key cryptography approach based on the algebraic structure of elliptic curves over finite fields — providing equivalent security to RSA with much smaller key sizes (256-bit ECC ≈ 3072-bit RSA), resulting in faster operations and lower resource consumption
  3. ECC is only useful for mobile devices and cannot be used in server-side cryptography applications
  4. ECC always uses the same key size as RSA for equivalent security levels

Answer : B
Explanation: ECC (Elliptic Curve Cryptography) is based on the ECDLP (Elliptic Curve Discrete Logarithm Problem) — much harder than RSA’s integer factorization for equivalent key sizes. Key size comparison: RSA 1024-bit ≈ ECC 160-bit (both insecure now). RSA 2048-bit ≈ ECC 224-bit. RSA 3072-bit ≈ ECC 256-bit. RSA 15360-bit ≈ ECC 521-bit. ECC advantages: Smaller keys: 256-bit ECC provides security equivalent to 3072-bit RSA. Faster: significantly faster key generation, signing, and verification. Lower resource usage: critical for IoT devices, smartcards, mobile. Same security, less bandwidth. ECC algorithms: ECDH (Elliptic Curve Diffie-Hellman): key exchange. ECDHE: ephemeral ECDH — provides Perfect Forward Secrecy. Used in TLS 1.3 exclusively. ECDSA (Elliptic Curve Digital Signature Algorithm): used in Bitcoin, TLS certificates, code signing. Common curves: P-256 (NIST curve, government standard), Curve25519 (faster, no NIST involvement — widely trusted), secp256k1 (Bitcoin’s curve). TLS 1.3 uses ECDHE with Curve25519 for key exchange and ECDSA for authentication. Quantum threat: ECC and RSA are both vulnerable to Shor’s algorithm on a sufficiently powerful quantum computer. Post-Quantum Cryptography (CRYSTALS-Kyber, CRYSTALS-Dilithium — NIST 2022 standard) will replace both.

72. What is network steganography and covert channels?

  1. Network steganography is a standard technique for compressing network packets to improve speed
  2. Network steganography hides secret messages within legitimate network traffic (unused header fields, timing patterns, protocol anomalies) — covert channels use unintended communication pathways in computer systems to secretly transmit information in violation of security policies
  3. Network steganography and covert channels are the same concept applied at different network layers
  4. Network steganography is only possible in encrypted VPN tunnels and not in regular internet traffic

Answer : B
Explanation: Network Steganography embeds hidden data within network protocol communication: IP header fields: ID field, TTL field, unused flags — can carry secret bits. TCP fields: sequence numbers, timestamp values, window size. DNS: encode data in subdomain queries (DNS exfiltration). ICMP: embed data in ping packet payloads. HTTP: hide data in HTTP headers, cookies, or white space. Covert Channels: communication paths that exist within a computer system not intended for information transfer, used to bypass security policies. Storage channels: communicate by modifying a shared storage object (file permissions, mutex names). Timing channels: communicate by varying the timing of operations (busy/idle patterns). Covert channel analysis (CCA): part of security evaluation for high-security systems (Common Criteria, Orange Book). Examples: Malware uses DNS tunneling to exfiltrate data (DNS queries bypass firewalls). Skimmer malware hides stolen credit card data in image files on the web server. State-sponsored malware hides C2 (command and control) communication in normal HTTP requests. Detection: deep packet inspection, statistical traffic analysis, network behavior analytics. Countermeasures: strict protocol conformance enforcement, anomaly detection, egress filtering, content inspection proxies. Network steganography is a serious advanced threat for high-security environments where traditional data exfiltration paths are blocked.

73. What is post-quantum cryptography and why is it being developed?

  1. Post-quantum cryptography is encryption designed for use after the current generation of computers becomes obsolete
  2. Post-quantum cryptography (PQC) refers to cryptographic algorithms designed to be secure against attacks from quantum computers — which could break RSA, ECC, and Diffie-Hellman using Shor’s algorithm, necessitating new mathematics-based alternatives like lattice-based, hash-based, and code-based cryptography
  3. Post-quantum cryptography means using quantum computers to encrypt data more securely than classical computers can
  4. Post-quantum cryptography is only a theoretical concern with no real-world urgency or timeline

Answer : B
Explanation: Quantum computers use quantum mechanics (superposition, entanglement) to solve certain problems exponentially faster than classical computers. Threat to current cryptography: Shor’s Algorithm: breaks RSA, ECC, Diffie-Hellman (all asymmetric cryptography). A quantum computer with ~4000 error-corrected qubits could break RSA-2048. Grover’s Algorithm: reduces symmetric key security by half. AES-128 becomes effectively AES-64 — INSECURE. AES-256 effectively becomes AES-128 — still secure. Impact: RSA/ECC/DH-based: encryption, digital signatures, TLS, PKI — ALL BROKEN. AES-256, SHA-384, SHA-512: secure (double key sizes). “Harvest now, decrypt later” attack: adversaries collect encrypted data now, decrypt when quantum computers are available. High-security data has years-long sensitivity windows. NIST Post-Quantum Standardization (2022 winners): CRYSTALS-Kyber: key encapsulation (KEM) — replaces RSA/ECDH for key exchange. CRYSTALS-Dilithium: digital signature — replaces RSA/ECDSA. FALCON: compact digital signature. SPHINCS+: hash-based digital signature (most conservative choice — security based only on hash function security). Timeline: Cryptographically relevant quantum computers: estimated 10-15 years. NIST PQC standards: being integrated into TLS, PKI infrastructure. “Crypto-agility” — design systems to swap algorithms easily when needed.

74. What is HTTPS certificate pinning and when is it used?

  1. Certificate pinning is the process of permanently fixing a certificate to a web server so it cannot be updated
  2. Certificate pinning is a technique where an application hard-codes the expected certificate or public key hash — rejecting any TLS certificate not matching the pinned value, even if it has a valid CA signature — preventing MITM attacks even with rogue CA certificates
  3. Certificate pinning is used by CAs to permanently lock certificates to specific domain names
  4. Certificate pinning is an obsolete technique replaced by HSTS in all modern browsers and applications

Answer : B
Explanation: Certificate Pinning enhances TLS security beyond standard CA trust. Standard TLS vulnerability: any of ~150+ trusted CAs globally can issue a certificate for any domain. If any CA is compromised (DigiNotar 2011), rogue certificates could impersonate legitimate sites. Certificate pinning: application stores hash of expected certificate or public key. During TLS: if received certificate/key hash doesn’t match pinned value → connection rejected. Even if attacker has a CA-signed certificate for the domain. Types: Certificate pinning: pin the full certificate. Fails when certificate is renewed. Public key pinning: pin the public key hash. Survives certificate renewal if same key is reused. Leaf pinning: pin the server’s certificate. CA/Intermediate pinning: pin a CA certificate. Pin multiple values for rotation. Use cases: Mobile banking apps (absolutely must pin — financial security critical). Mobile apps connecting to specific backend APIs. Corporate certificate management. Problems: Operational complexity: certificate renewal requires app update if pinned incorrectly. App breakage: incorrect pin causes connection failure. Maintenance overhead: managing pins across app versions. HPKP (HTTP Public Key Pinning): browser-based pinning. Deprecated in 2018 — too dangerous (one mistake makes site inaccessible). Certificate Transparency: better alternative for browser-based pinning concerns.

75. What is the difference between encoding, encryption, and hashing?

  1. Encoding, encryption, and hashing are three names for the same data transformation process
  2. Encoding converts data format for compatibility (reversible without a key — no security); encryption transforms data to protect confidentiality (reversible with the correct key — provides security); hashing produces a fixed-size fingerprint (one-way, irreversible — used for integrity verification and password storage)
  3. Encryption is more secure than hashing; encoding is only used for audio and video files
  4. Hashing is reversible if you have the original hash function used to create the hash value

Answer : B
Explanation: Encoding: converts data to a different format for compatibility, not security. Completely reversible without any secret key. Base64: encodes binary data as ASCII text. Used in email attachments, JWTs, data URLs. URL encoding: %20 for space, %3C for <. Anyone who knows the encoding scheme can decode it instantly. NOT encryption — provides ZERO security. A common mistake: "we encoded the password in Base64" is NOT security. Encryption: transforms data to protect confidentiality. Requires a key to decrypt. Symmetric: AES. Asymmetric: RSA, ECC. Produces ciphertext that is meaningless without the key. Provides confidentiality. Reversible with key. Hashing: one-way transformation producing a fixed-size digest. NOT reversible — cannot get original data from hash. No key involved (though HMAC adds a key for authentication). Properties: same input always produces same output, tiny input change → completely different output (avalanche effect). Uses: password storage (store hash, never plaintext), data integrity (verify file hasn't changed), digital signatures (sign the hash of a message), blockchain (Merkle trees). Common mistake: "we hashed the password with MD5" — MD5 is broken, no salt used, rainbow tables work. Correct: bcrypt("password", rounds=12) — adds salt, designed to be slow.

76. What is a zero-day vulnerability and how does it relate to network security?

  1. A zero-day vulnerability is a bug that takes zero days to patch once discovered by the vendor
  2. A zero-day vulnerability is a software security flaw that is unknown to the software vendor — attackers can exploit it before developers have a chance to create and distribute a patch, making it especially dangerous as there is no fix available
  3. Zero-day vulnerabilities only affect very old software that has not been updated for years
  4. A zero-day is a vulnerability that was discovered zero days ago and is immediately patched

Answer : B
Explanation: A Zero-Day Vulnerability is a security flaw unknown to the vendor. The name means “zero days” of protection — vendor has had zero days to develop a fix. Lifecycle: Researcher/attacker discovers vulnerability. Exploitation begins. Eventually: vendor discovers OR researcher discloses. Vendor releases patch (now it’s a “one-day” or “n-day” vulnerability). Users must patch quickly. Zero-day exploit: code that takes advantage of a zero-day vulnerability. Zero-day market: government agencies (NSA, CIA, Chinese APTs) pay millions for zero-days in target software. Zerodium paid $2.5M for iOS zero-day. Nation-state actors: ShadowBrokers leaked NSA zero-days in 2017 → WannaCry used EternalBlue zero-day that had been patched, but unpatched systems vulnerable. Stuxnet: used 4 zero-day vulnerabilities targeting Iranian nuclear centrifuges — most sophisticated cyberweapon ever discovered. Defense against zero-days: Defense in depth: assume any software has unknown vulnerabilities. Network segmentation: limit damage from exploitation. Behavioral-based endpoint detection: detect exploitation behavior, not just known signatures. Principle of least privilege: exploit’s damage limited if compromised process has minimal rights. Sandboxing: isolate processes. Patch quickly: once a patch exists, zero-day becomes n-day — patch before attackers pivot to patched systems.

77. What is the CIA triad in information security?

  1. The CIA triad refers to the Central Intelligence Agency’s three-tier classification system for secrets
  2. The CIA triad is the foundational model of information security comprising Confidentiality (only authorized parties access information), Integrity (information is accurate and unaltered), and Availability (authorized parties can access information when needed)
  3. The CIA triad refers to Cryptography, Identification, and Authentication in cybersecurity
  4. The CIA triad is a network protocol defining three security levels for data transmission

Answer : B
Explanation: The CIA Triad is the foundational model for information security policy and design. Confidentiality: ensuring information is accessible only to those authorized. Violations: data breaches, unauthorized access, eavesdropping. Controls: encryption (AES, TLS), access controls (RBAC), authentication (passwords, MFA), data classification, NDAs. Cryptography’s primary contribution: symmetric and asymmetric encryption. Integrity: ensuring information is accurate, complete, and not tampered with. Violations: data modification, file corruption, unauthorized changes. Controls: hash functions (SHA-256), digital signatures, checksums, version control, audit logs, access controls. Cryptography’s primary contribution: hash functions and MACs. Availability: ensuring systems and data are accessible to authorized users when needed. Violations: DoS/DDoS attacks, hardware failure, natural disasters. Controls: redundancy, load balancing, backups, disaster recovery, DDoS mitigation, UPS power. Beyond CIA — DAD model (attacker’s goals): Disclosure (attack on Confidentiality), Alteration (attack on Integrity), Denial/Destruction (attack on Availability). Extended model (Parkerian Hexad adds): Possession/Control, Authenticity, Utility. Application: every security decision should be evaluated against: which CIA property does this protect? Which threat does it mitigate? The triad helps prioritize security investments based on which property is most critical for each system.

78. What is stealth scanning and port scanning in network security?

  1. Port scanning is a visual inspection technique for identifying physical network cable connections
  2. Port scanning discovers which ports (and therefore services) are open and listening on a target host — stealth scanning (SYN scan/half-open scan) attempts to discover open ports without completing the TCP handshake to avoid detection and logging by the target
  3. Port scanning is only possible on servers running Linux — Windows and macOS cannot be scanned
  4. Stealth scanning makes network traffic completely invisible and undetectable by all network tools

Answer : B
Explanation: Port scanning is a fundamental reconnaissance technique used by both security professionals and attackers. Types of scans (Nmap): TCP Connect Scan (-sT): completes the full three-way handshake. Very reliable. Easy to detect and log. SYN Scan (-sS / Stealth Scan): sends SYN packet. If port open: receives SYN-ACK, sends RST (never completes handshake). If port closed: receives RST. Never completes connection → often not logged. Requires root privileges. Default Nmap scan. UDP Scan (-sU): sends UDP packets. If closed: ICMP port unreachable. If open: no response or service response. Slower than TCP. FIN/NULL/Xmas Scans: send unusual flag combinations to bypass firewalls. Less reliable. OS Fingerprinting (-O): analyze responses to identify operating system. Version Detection (-sV): identify service versions (e.g., Apache 2.4.51). Nmap: the most widely used port scanner. Used for: network inventory, security assessments, vulnerability identification. Detection: IDS/IPS with signature-based detection. Connection rate monitoring (many connections in short time). Firewall logging. Countermeasures: Firewalls blocking unnecessary ports (default-deny). Port knocking: ports only open after specific sequence. Honeypots: fake open ports that alert when scanned. Defense: only open necessary ports, keep services updated.

79. What is the role of entropy in cryptography?

  1. Entropy in cryptography refers to the amount of heat generated by cryptographic operations on CPU
  2. Entropy is a measure of randomness or unpredictability in a cryptographic system — high entropy means values are difficult to predict, making keys, IVs, nonces, and random numbers cryptographically strong; low entropy leads to predictable values that can be guessed or brute-forced
  3. Entropy is only relevant for password strength and has no impact on encryption key generation
  4. High entropy means a system uses more computational resources — it is always a negative property

Answer : B
Explanation: Entropy (from information theory, Claude Shannon) measures the unpredictability of a data source. In cryptography: cryptographic security fundamentally relies on randomness. Predictable random = broken security. Sources of entropy: Hardware: thermal noise in resistors, radioactive decay, CPU timing jitter, hard disk seek time, mouse movements, keyboard timing. Software: /dev/urandom (Linux/macOS), CryptGenRandom (Windows), hardware random number generators (Intel RDRAND). CSPRNG (Cryptographically Secure Pseudo-Random Number Generator): takes entropy seed and generates a deterministic but computationally unpredictable sequence. Examples: AES-CTR DRBG, ChaCha20 DRBG. Password entropy: “password” (1 entropy bit ≈ can be guessed instantly). “aB3$kL9!” (50+ bits ≈ much harder to brute-force). Entropy per character: lowercase letters only: log₂(26) ≈ 4.7 bits. Alphanumeric + symbols: log₂(96) ≈ 6.5 bits. Passphrase: “correct horse battery staple” — 4 words × 11 bits = 44 bits from dictionary of 2048 words. Low entropy attacks: PS3 random number generation flaw (constant seed) → private keys broken, games pirated. Dual_EC_DRBG (NSA backdoored RNG in NIST standard 2006-2013): weak entropy enabled surveillance. Key generation: always use a proper CSPRNG. Never use Math.random() for cryptographic purposes (not a CSPRNG).

80. What is network access control (NAC) and 802.1X authentication?

  1. NAC is a firewall product that controls the speed of network access for different device types
  2. NAC is a security solution that enforces policy compliance before granting network access — 802.1X is the IEEE standard for port-based network access control that authenticates devices before allowing them onto the network using EAP (Extensible Authentication Protocol) and a RADIUS server
  3. 802.1X is only applicable to Wi-Fi networks and cannot be used on wired Ethernet connections
  4. NAC and 802.1X are only used by government organizations for high-security networks

Answer : B
Explanation: NAC (Network Access Control) ensures only authorized and compliant devices access the network. Policy enforcement: device authentication, OS patch level check, antivirus status, firewall enabled, certificate presence. Non-compliant devices: quarantined to limited remediation network. 802.1X Port-based NAC: IEEE standard for controlling network access at the physical level. Components: Supplicant: software on the device requesting access (Windows, macOS built-in). Authenticator: network switch or Wi-Fi AP (acts as proxy). Authentication Server: RADIUS server (FreeRADIUS, Cisco ISE, Microsoft NPS). Process: Device connects to switch port. Switch port in unauthorized state (EAPOL only). 802.1X supplicant sends EAP-Identity. Switch forwards to RADIUS server. RADIUS authenticates using: EAP-TLS (certificate-based — strongest), PEAP (MS-CHAPv2 password over TLS tunnel), EAP-TTLS. On success: RADIUS instructs switch to authorize port. Network access granted. On failure: port stays in unauthorized state. EAP types: EAP-TLS: client and server present certificates. Strongest — no password vulnerabilities. PEAP (Protected EAP): encapsulates inner EAP in TLS tunnel. MSCHAPV2 inner method. 802.1X protects against: rogue devices plugging into corporate network ports, credential-based network access, network segmentation bypass. Enterprise Wi-Fi (WPA2/WPA3-Enterprise): uses 802.1X with RADIUS for per-user authentication instead of a shared PSK.

Pages: 1 2 3 4 5 6 7 8 9 10