Networks, Linux and Systems: The Technical Foundations of Cybersecurity Quiz

Quiz: Applied cryptography

Pass mark: 70%. You can retry as many times as you need.

1 A website stores its users' passwords as plain unsalted SHA-256 hashes. What is the main weakness? Single answer SHA-256 cannot be computed on a server. Hashes can be decrypted with the server's private key. The hash is too long to be stored. It is fast and unsalted, so stolen hashes can be guessed massively and identical passwords are visible.

2 Which statements about hashing and encryption are correct? (several answers) Multiple answers possible A hash is deterministic: the same input always gives the same hash. A hash can be decrypted with the right key. Changing one character of the input changes the hash completely. Encryption is reversible by whoever has the right key.

3 Alice wants to send Bob a confidential message using public-key cryptography, without having shared a secret with him beforehand. What should she do? Single answer Encrypt with her own private key. Encrypt with Bob's public key. Send the message hashed with SHA-256. Encrypt with Bob's private key.

4 Why do TLS connections combine asymmetric and symmetric cryptography? Single answer Symmetric encryption is only used for the certificate. Asymmetric cryptography is slow but solves key agreement and authentication; symmetric is fast for the data. Browsers cannot use asymmetric cryptography for more than one site. The two are redundant and chosen at random.

5 A developer accidentally commits an API key to a public repository, then deletes the file in the next commit. What should be done? (several answers) Multiple answers possible Nothing: the file has been deleted, so the problem is solved. Revoke the key and issue a new one. Check access logs for use of the key during the exposure. Move future secrets to a secrets manager or protected configuration outside the code.