Cryptography and Network Security MCQ Questions And Answers

Cryptography and Network Security MCQ Questions And Answers

81. What is a rainbow table attack and how does salting prevent it?

  1. A rainbow table attack uses multiple colorful displays to visually crack encryption keys
  2. A rainbow table is a precomputed lookup table mapping hash values to their corresponding plaintext inputs — allowing instant password recovery from hashes; salting prevents this by adding a unique random value to each password before hashing, making precomputed tables useless
  3. Rainbow tables are only effective against passwords longer than 20 characters in length
  4. Salting is only needed for SHA-256 hashes — MD5 and SHA-1 are immune to rainbow table attacks

Answer : B
Explanation: Rainbow Table attack: precompute hash(password) for millions of common passwords and store as a lookup table. When a password hash is stolen from a database: look up the hash in the table. Instant recovery if the password was in the table. Tables for MD5/SHA-1 of all 8-character passwords are freely downloadable. Without salt: if two users have the same password → same hash → both cracked at once. Salting — the fix: generate a random value (salt) for each user. Store hash(password + salt). salt is stored in plaintext alongside the hash. Now to crack: attacker must rebuild the entire rainbow table for each unique salt. For 1M users with unique salts → 1M separate rainbow tables needed. Makes precomputation infeasible. Effectively forces per-user brute force. Proper password hashing algorithms: bcrypt: built-in salt + adaptive cost factor (work factor). Standard for years. scrypt: memory-hard + bcrypt properties. Harder to parallelize. Argon2 (OWASP recommended): winner of Password Hashing Competition 2015. Three variants: Argon2i (side-channel resistant), Argon2d (fast brute-force resistant), Argon2id (recommended — balanced). Why not raw SHA-256? SHA-256 is designed to be fast (>1 billion hashes/second on a GPU). Argon2 is deliberately slow (0.3 seconds per hash). 1 billion attempts/second vs. 3 per second — Argon2 is millions of times harder to crack. Use bcrypt or Argon2 — never roll your own password hashing.

82. What is DNS Security (DNSSEC) and what attacks does it prevent?

  1. DNSSEC encrypts DNS queries and responses to prevent eavesdropping on DNS lookups
  2. DNSSEC adds digital signatures to DNS records — allowing resolvers to verify that DNS responses are authentic and have not been tampered with, preventing DNS spoofing and cache poisoning attacks, though it does not encrypt DNS query content
  3. DNSSEC is a firewall extension that blocks malicious DNS lookups at the network perimeter
  4. DNSSEC and DNS over HTTPS are identical technologies with different implementation approaches

Answer : B
Explanation: DNS (Domain Name System) is fundamental internet infrastructure but originally has no authentication. DNS Attacks: DNS Cache Poisoning (Kaminsky attack 2008): attacker injects fake DNS records into a resolver’s cache. All users of that resolver receive wrong IP addresses. DNS Spoofing: attacker sends fake DNS responses to a specific client. BGP hijacking affecting DNS: redirect all DNS traffic. DNSSEC adds cryptographic signatures to DNS: Zone signing: DNS zone signs its records with private key. Public key published as DNSKEY record. Chain of trust: Root → TLD (.com) → Domain — each level signs the next level’s key. Resolver verification: resolver validates signatures up to the trusted root. If signature doesn’t match → query fails → no cached poisoned entry. What DNSSEC does NOT do: Does NOT encrypt DNS queries. Queries are still visible to anyone on the path. DNS over HTTPS (DoH): encrypts DNS queries in HTTPS traffic. Prevents eavesdropping on which sites you’re visiting. DNS over TLS (DoT): encrypts DNS over TLS (port 853). Complementary to DNSSEC (which provides integrity; DoH/DoT provides confidentiality). DANE (DNS-Based Authentication of Named Entities): uses DNSSEC to publish TLS certificate information. Allows domain owners to specify which CA can issue certificates — prevents rogue CA attacks without browser dependency.

83. What is a honeynet and honeypot in network security?

  1. A honeypot is a sweetened authentication credential used to attract legitimate users to a secure login page
  2. A honeypot is a decoy system designed to attract and trap attackers — appearing to be a legitimate target but actually monitoring and recording all attacker activity to gain threat intelligence; a honeynet is a network of multiple honeypots forming a decoy environment
  3. Honeypots are performance testing systems used to simulate heavy network loads for capacity planning
  4. A honeypot prevents attacks by creating a diversionary target that automatically blocks attacker IP addresses

Answer : B
Explanation: Honeypots are deceptive security tools. Types: Low-interaction honeypot: simulates services (emulates open ports, simple responses). Easy to set up, lower risk. Limited data collection. Medium-interaction: simulates more realistic services with vulnerabilities. High-interaction honeypot: real operating systems and services. Captures detailed attacker behavior. Higher maintenance and risk (attacker could use it as a springboard). Honeynet: full network of multiple honeypots + real-looking infrastructure. Honeytoken: fake credentials, fake files, fake database records. If accessed → alert (legitimate users would never touch these). Uses: Threat intelligence gathering: study new malware, attack techniques, tools. Early warning: any connection to a honeypot = suspicious activity. Deception: slow down attackers, waste their time. Legal evidence collection. Attacker attribution research. Honeypot placement: DMZ honeypots: catch external attackers. Internal honeypots: detect insider threats and lateral movement. Canary tokens: lightweight honeytokens embedded in documents, databases, DNS. Any access triggers an alert (canarytokens.org). Legal considerations: legal to run honeypots to attract attackers. Entrapment concerns vary by jurisdiction. Ensure honeypot cannot be used to attack third parties (liability). Project Honeynet: global research organization studying attacker behavior.

84. What is a PKI certificate chain and how is trust established in browsers?

  1. A certificate chain is a series of symmetric encryption keys linked in a specific security order
  2. A certificate chain is a hierarchical sequence from a Root CA through one or more Intermediate CAs to an end-entity certificate — each certificate is signed by the one above it, and trust is established by verifying the chain up to a Root CA pre-installed in the browser or OS trust store
  3. Certificate chains require a live internet connection to verify trust for every HTTPS connection
  4. All HTTPS websites use the same single root certificate that browsers trust universally

Answer : B
Explanation: Certificate Chain of Trust: Root CA (e.g., DigiCert Root G5): self-signed certificate. Pre-installed in browsers and operating systems (~150 trusted roots). Offline, air-gapped — only used to sign intermediate CAs. Intermediate CA (e.g., DigiCert SHA2 Secure Server CA): signed by Root CA. Issues end-entity certificates to website operators. Can be revoked and replaced without touching the Root. End-Entity Certificate (e.g., *.google.com): signed by Intermediate CA. Contains the server’s public key. Contains SANs (Subject Alternative Names) — valid domain names. Browser verification process: Browser connects to google.com. Server sends its certificate + intermediate CA certificate. Browser builds the chain: google.com cert ← signed by Intermediate CA. Intermediate CA cert ← signed by Root CA. Root CA is in browser trust store. Browser verifies each signature in the chain. Checks certificate validity dates and revocation (OCSP/CRL). Checks domain name matches. If all checks pass → green padlock. Why Intermediate CAs? Root CAs are kept offline. If a server’s certificate is compromised, only that certificate needs revocation. If an Intermediate CA is compromised, only it needs revocation (not the Root). Root CA compromise would require updating ALL browsers/OS trust stores — catastrophic. Browser/OS trust stores are updated via software updates. Certificate pinning: hardcodes expected certificate into apps for extra verification.

85. What is the principle of least privilege in network security?

  1. Least privilege means giving users the slowest and least powerful hardware for security purposes
  2. The principle of least privilege states that every user, process, and system component should have only the minimum access rights and permissions necessary to perform its legitimate function — reducing the attack surface and limiting damage from breaches or compromises
  3. Least privilege means only privileged (administrator) users can access the network at all
  4. The least privilege principle only applies to database access and not to network or system resources

Answer : B
Explanation: Principle of Least Privilege (PoLP) is one of the most fundamental security principles. Applications: User accounts: most employees need no administrator rights. Create standard user accounts, use separate admin accounts only when needed. Service accounts: web server should not run as root/SYSTEM. Use dedicated service account with only required permissions. Database accounts: application database user should only have SELECT/INSERT/UPDATE on needed tables — not DROP/CREATE. File system: files readable only by the processes that need them. Network: firewall rules allow only necessary ports and protocols between systems. Linux: sudo for specific commands rather than su for full root shell. Windows: UAC (User Account Control). Cloud IAM: AWS IAM policies follow least privilege (deny by default, explicit allow). Zero Trust: assumes breach — verify continuously, never trust based on network location. Defense in Depth using PoLP: even if attacker compromises a low-privilege account (XSS on web server), they cannot immediately access databases, other systems, or admin functions. Lateral movement is severely limited. Example violation: running everything as root/Administrator — any vulnerability gives attacker full system control. Implementation: regular access reviews, role-based access control, just-in-time access, privileged access management (PAM) solutions.

86. What is network segmentation and why is it important for security?

  1. Network segmentation divides internet bandwidth into equal segments for all users on the network
  2. Network segmentation divides a network into separate, isolated zones (using VLANs, firewalls, subnets) with controlled access between zones — containing breaches, limiting lateral movement, protecting critical assets, and reducing the blast radius of security incidents
  3. Network segmentation is only used by large organizations with more than 10,000 employees
  4. Network segmentation increases attack surface by creating more network interfaces to protect

Answer : B
Explanation: Network Segmentation implements “defense in depth” at the network layer. Without segmentation: flat network — one compromised host can reach everything. Ransomware spreads to all systems instantly. Attacker moves laterally to domain controllers, databases, critical systems. With segmentation: compromised workstation in user VLAN cannot reach database VLAN. Attacker must break through each firewall/ACL to reach next segment. Dramatically slows lateral movement — gives defenders time to detect and respond. Segmentation approaches: VLANs (Virtual LANs): logical separation at Layer 2. Different departments in separate VLANs. Firewall policies between VLANs. Subnets with ACLs: routed separation at Layer 3. DMZ (Demilitarized Zone): semi-trusted zone for public-facing servers (web, email, DNS). Isolated from internal network. If web server compromised, attacker in DMZ cannot directly reach internal HR/finance systems. Zero Trust micro-segmentation: every workload protected individually. East-west traffic (between internal systems) as scrutinized as north-south (external). Common zones: Internet → DMZ → Application zone → Database zone → Management zone → OT/SCADA (physically isolated). Compliance: PCI DSS requires cardholder data environment (CDE) to be segmented from other networks. HIPAA requires PHI systems to be isolated. Example: Colonial Pipeline attack — ransomware spread from office IT network to OT network because they were not sufficiently segmented.

87. What is a digital forensics investigation in the context of cybersecurity?

  1. Digital forensics is the process of manually testing software for bugs before deployment
  2. Digital forensics is the systematic process of collecting, preserving, analyzing, and presenting digital evidence from computers, networks, and storage devices — following strict procedures to maintain evidence integrity and chain of custody for legal proceedings or incident investigation
  3. Digital forensics only applies to criminal investigations and has no role in corporate security incidents
  4. Digital forensics can only be performed by law enforcement agencies with court orders

Answer : B
Explanation: Digital forensics is applied to both legal proceedings and corporate incident response. Phases: Identification: identify potential sources of digital evidence. Collection: acquire evidence following strict procedures. Order of volatility (collect most volatile first): CPU registers and cache → RAM → Network connections → Running processes → Disk storage. Preservation: ensure evidence is not altered. Write blockers prevent writes to physical storage during imaging. Cryptographic hash (MD5/SHA-256) of drive image taken immediately — proves evidence integrity. Chain of custody: documented record of who handled evidence, when, and how. Examination: extract relevant data from acquired evidence. Analysis: interpret extracted data to reconstruct events. Presentation: present findings clearly (technical and non-technical audiences). Court-admissible format. Tools: Autopsy, FTK (Forensic Toolkit), EnCase, Volatility (memory analysis), Wireshark (network captures), dd (disk imaging), Sleuth Kit. Cryptography in forensics: encrypted evidence is a major challenge — without keys, encrypted data is unreadable. TrueCrypt/VeraCrypt full disk encryption: legal tools (compelled disclosure) or brute force attempts. Live acquisition: capturing RAM before shutdown may recover encryption keys. Anti-forensics: attackers delete logs, overwrite disk space, use encrypted communications. Modern endpoint detection and response (EDR) solutions maintain tamper-resistant logging to cloud.

88. What is the difference between a private key and a public key and how is key pair generated?

  1. The private key encrypts data; the public key decrypts it — they are completely interchangeable
  2. In asymmetric cryptography, the public key can be freely shared (used to encrypt data or verify signatures) while the private key is kept secret (used to decrypt data or create signatures) — mathematically linked so that the private key can be derived only computationally infeasibly from the public key
  3. Public and private keys in RSA are identical in size and mathematical properties
  4. The public key is generated first and the private key is derived from it during key generation

Answer : B
Explanation: Key pair properties: Public Key: can be freely distributed, published in certificates, included in emails. Used to: Encrypt data for the owner. Verify the owner’s digital signature. Private Key: must never be shared. Known only to the owner. Used to: Decrypt data encrypted with corresponding public key. Create digital signatures. Key operations: Alice’s public key encrypts → only Alice’s private key decrypts. Alice’s private key signs → anyone with Alice’s public key can verify. RSA key generation: Choose two large primes p, q (each 1024+ bits for RSA-2048). n = p × q (public modulus). φ(n) = (p-1)(q-1) (Euler’s totient). Choose e such that 1 < e < φ(n) and gcd(e, φ(n)) = 1 (typically 65537). d = e⁻¹ mod φ(n) (modular inverse). Public key: (e, n). Private key: (d, n). p, q, φ(n) discarded. Security: knowing (e, n) does not allow computing d without knowing p and q (factoring n is hard). Key storage: HSM (Hardware Security Module): tamper-resistant hardware for private key storage. Smart cards. TPM (Trusted Platform Module): secure key storage in modern computers. Private keys encrypted with passphrase and stored in files (PEM format). Never email private keys, never store on shared systems.

89. What is the concept of non-repudiation in cryptography?

  1. Non-repudiation means that encrypted data cannot be repurposed or reused after decryption
  2. Non-repudiation is the assurance that someone cannot falsely deny having performed an action — in cryptography, digital signatures using private keys provide non-repudiation because only the key holder could have produced the signature, creating an undeniable proof of origin
  3. Non-repudiation prevents users from changing their passwords to deny previous authentication events
  4. Non-repudiation is a property only required for government and legal documents, not regular communications

Answer : B
Explanation: Non-repudiation prevents parties from denying their actions after the fact. Why it matters: “I never sent that payment instruction” — without non-repudiation, parties can deny transactions. How digital signatures provide non-repudiation: Alice signs a message with her private key. Only Alice has her private key (if properly protected). Anyone can verify the signature with Alice’s public key. Alice cannot credibly deny having signed the message. Contrast with MACs: MACs use shared keys — both sender and receiver have the same key. Either party could have created the MAC. MAC does NOT provide non-repudiation. Non-repudiation requirements: Private key security: if Alice’s private key is stolen, attacker can forge her signatures. She could claim her key was compromised. Timestamp authorities: prove WHEN a signature was created. Certificate Authorities: prove WHO the private key belongs to. Audit trails: logs capturing actions (with cryptographic integrity protection). Applications: Electronic contracts and agreements (e-signatures). Financial transactions and trading. Email signing (S/MIME) for professional communications. Code signing: software author cannot deny releasing malicious code. Blockchain: transaction signatures provide non-repudiation. Legal enforceability: many jurisdictions have electronic signature laws (eIDAS in EU, ESIGN Act in USA) giving digital signatures legal weight equivalent to handwritten signatures.

90. What is BGP hijacking and what security mechanisms exist to prevent it?

  1. BGP hijacking is a technique to increase internet bandwidth by optimizing routing paths
  2. BGP hijacking is an attack where a malicious actor falsely announces BGP routes to redirect internet traffic through their infrastructure — enabling eavesdropping, traffic manipulation, or blackholing; RPKI (Resource Public Key Infrastructure) uses digital certificates to validate BGP route origins
  3. BGP hijacking only affects small ISPs and cannot impact major internet providers or websites
  4. BGP is a Layer 2 protocol and BGP hijacking is prevented by MAC address filtering

Answer : B
Explanation: BGP (Border Gateway Protocol) is the routing protocol that determines how traffic flows across the internet between autonomous systems (AS). BGP has no built-in authentication — historically any AS can announce any IP prefix. BGP Hijacking: attacker announces more specific or conflicting routes for IP blocks they don’t own. Other routers accept the more specific route (longest prefix match). Traffic for victims flows to attacker. Types: Traffic interception: attacker receives traffic, inspects it, forwards to real destination (MITM). Blackholing: attacker drops all traffic (DoS). Route leak: accidental misconfiguration causes widespread routing disruption. Famous incidents: 2010: China Telecom announced routes for 15% of internet for 18 minutes. 2018: MyEtherwallet DNS hijacking via BGP (BGP + DNS + certificate theft). 2019: Google traffic hijacked through Nigeria/Russia. Prevention: RPKI (Resource Public Key Infrastructure): cryptographic attestation that an AS is authorized to originate specific IP prefixes. Route Origin Validation (ROV): routers check RPKI before accepting routes. Gradually being deployed. BGPsec: cryptographically signs BGP path attributes. Provides full path verification. Complex deployment. Still limited adoption. IRR (Internet Routing Registry): organizations register their routing policies. Not cryptographic — easy to forge. Peer filtering: ISPs only accept routes their peers are authorized to originate. Significant manual effort.

Pages: 1 2 3 4 5 6 7 8 9 10