Software Security And Testing WGU D385: Questions
With Accurate Solutions
What hash function should you use for most general purpose cryptographic
hashing? Correct Answer - SHA-256
What hash function should you consider using for high security environments,
though it may have less support? Correct Answer - SHA3-256
What hash function should you use for very large messages? Correct
Answer - BLAKE2
What two hash functions should you avoid, as they're now considered
unsecure? Correct Answer - MD5 and SHA1
What is the difference between hash functions and checksum functions?
Correct Answer - Hash functions have stronger collision resistance,
checksums are faster. Checksums are not useful for security.
What module do you use for cryptographic hashing in Python? Correct
Answer - hashlib
What 3 properties characterize hash functions? Correct Answer - 1.
Deterministic behavior 2. Fixed-length hash values 3. Avalanche effect
Should you use the secrets or random module for generating secure random
numbers? Correct Answer - secrets
What do keyed hash functions do? Correct Answer - Hash functions using
different keys produce different hash values of the same message. Hash
functions using the same key produce matching hash values of the same
message. Ensures data authentication.
What are HMAC functions? Correct Answer - A generic way to use any
ordinary hash function as though it were a keyed hash function, since most
hash functions don't support keys natively. Takes 3 inputs: message, key,
ordinary cryptographic hash function.
, What is a timing attack? Correct Answer - Attacker obtains hints about
private information by measuring the time a system takes to perform an
operation (ex: string comparison)
How can you avoid a timing attack with the hmac module? Correct Answer -
You can use compare_digest in place of ==. This always compares all
characters before it returns thus preventing timing attack vulnerabilities.
What is a side channel attack? Correct Answer - Derives unauthorized
information by measuring any physical side channel (such as time sound,
power consumption, electromagnetic radiation, radio waves, and heat)
Python has no native encryption API, so what might you use instead?
Correct Answer - cryptography or pycryptodome packages
When using the high level "recipes layer" API of cryptography, what
protocol/class will you be interacting with? Correct Answer - Fernet
How is a fernet token created? Correct Answer - The Fernet.encrypt
method encrypts the plaintext and then also hashes the ciphertext with
HMAC-SHA256.
What class is used in combination with Fernet to implement key rotation?
Correct Answer - MultiFernet class
How does key rotation work? Correct Answer - All ciphertext created with
the old key must be decrypted, then re-encrypted with the new key. Then the
old key can be retired.
What is symmetric encryption? Correct Answer - When an encryption
algorithm both encrypts and decrypts with the same key. (ex: Fernet)
What are block ciphers? Correct Answer - Symmetric encryption
algorithms that encrypt plaintext as a series of fixed-length blocks. Each block
of plaintext is encrypted to a block of cyphertext. Block size depends on the
algorithm.
What is the current most popular symmetric encryption algorithm? Correct
Answer - Advanced Encryption Standard (AES)
With Accurate Solutions
What hash function should you use for most general purpose cryptographic
hashing? Correct Answer - SHA-256
What hash function should you consider using for high security environments,
though it may have less support? Correct Answer - SHA3-256
What hash function should you use for very large messages? Correct
Answer - BLAKE2
What two hash functions should you avoid, as they're now considered
unsecure? Correct Answer - MD5 and SHA1
What is the difference between hash functions and checksum functions?
Correct Answer - Hash functions have stronger collision resistance,
checksums are faster. Checksums are not useful for security.
What module do you use for cryptographic hashing in Python? Correct
Answer - hashlib
What 3 properties characterize hash functions? Correct Answer - 1.
Deterministic behavior 2. Fixed-length hash values 3. Avalanche effect
Should you use the secrets or random module for generating secure random
numbers? Correct Answer - secrets
What do keyed hash functions do? Correct Answer - Hash functions using
different keys produce different hash values of the same message. Hash
functions using the same key produce matching hash values of the same
message. Ensures data authentication.
What are HMAC functions? Correct Answer - A generic way to use any
ordinary hash function as though it were a keyed hash function, since most
hash functions don't support keys natively. Takes 3 inputs: message, key,
ordinary cryptographic hash function.
, What is a timing attack? Correct Answer - Attacker obtains hints about
private information by measuring the time a system takes to perform an
operation (ex: string comparison)
How can you avoid a timing attack with the hmac module? Correct Answer -
You can use compare_digest in place of ==. This always compares all
characters before it returns thus preventing timing attack vulnerabilities.
What is a side channel attack? Correct Answer - Derives unauthorized
information by measuring any physical side channel (such as time sound,
power consumption, electromagnetic radiation, radio waves, and heat)
Python has no native encryption API, so what might you use instead?
Correct Answer - cryptography or pycryptodome packages
When using the high level "recipes layer" API of cryptography, what
protocol/class will you be interacting with? Correct Answer - Fernet
How is a fernet token created? Correct Answer - The Fernet.encrypt
method encrypts the plaintext and then also hashes the ciphertext with
HMAC-SHA256.
What class is used in combination with Fernet to implement key rotation?
Correct Answer - MultiFernet class
How does key rotation work? Correct Answer - All ciphertext created with
the old key must be decrypted, then re-encrypted with the new key. Then the
old key can be retired.
What is symmetric encryption? Correct Answer - When an encryption
algorithm both encrypts and decrypts with the same key. (ex: Fernet)
What are block ciphers? Correct Answer - Symmetric encryption
algorithms that encrypt plaintext as a series of fixed-length blocks. Each block
of plaintext is encrypted to a block of cyphertext. Block size depends on the
algorithm.
What is the current most popular symmetric encryption algorithm? Correct
Answer - Advanced Encryption Standard (AES)
