Applications of Cryptography
Free EC-Council Certified Encryption Specialist practice — 6 questions on Applications of Cryptography, with explanations. No sign-up. Full 12-question mixed test →
A company connects two branch offices over an IPsec VPN. The tunnel must traverse a NAT device between the sites, and the traffic must be both encrypted and authenticated. Which IPsec protocol should be selected, and why?
ESP (Encapsulating Security Payload) provides confidentiality and optional integrity for the payload, and because it does not authenticate the outer IP header, it works correctly with NAT (often combined with NAT-T using UDP encapsulation). AH authenticates the entire packet including the IP header, which breaks when NAT rewrites addresses.
In a Kerberos authentication exchange, after the client receives a Ticket Granting Ticket (TGT) from the Authentication Server, what does the client send to the Ticket Granting Service (TGS) to obtain a service ticket?
The client presents the TGT plus a freshly generated authenticator (encrypted with the TGT session key) in the TGS-REQ, proving it possesses the session key without resending credentials, and the TGS then issues a service ticket.
WPA3's Simultaneous Authentication of Equals (SAE) is considered resistant to offline dictionary attacks that plague WPA2-PSK's 4-way handshake. What is the primary reason for this resistance?
SAE (based on the Dragonfly handshake) derives the Pairwise Master Key through an interactive exchange tied to the AP, so an attacker cannot capture a single exchange and brute-force it offline; each guess requires interacting with the live AP, which is rate-limitable.
An organization's root CA certificate must be able to issue certificates to subordinate (intermediate) CAs, which in turn issue end-entity certificates. Which X.509 v3 extension and setting enables this delegation of CA authority?
The Basic Constraints extension explicitly marks a certificate as a CA certificate (CA=TRUE) and can restrict the certification path length via pathLenConstraint, which is what permits a certificate to sign subordinate CA certificates.
TLS 1.3 removed several legacy key exchange options present in TLS 1.2. Which key exchange mechanism does TLS 1.3 mandate for its standard full handshake to guarantee forward secrecy?
TLS 1.3 removed static RSA key exchange entirely and requires (EC)DHE for its standard handshake, ensuring that a compromised long-term private key cannot be used to decrypt previously captured sessions, i.e., forward secrecy.
A forensic analyst examines a VeraCrypt-encrypted container. The container contains a hidden volume nested inside an outer decoy volume, and there is no cryptographic or structural evidence indicating the hidden volume exists without the correct hidden-volume password. This capability is best classified as an example of:
VeraCrypt's hidden volume feature hides an encrypted volume inside the free space of an outer volume such that its existence cannot be proven, giving the user plausible deniability — a data-hiding concept closely related to steganography, where the goal is concealing the existence of data, not just its content.
Ready for the real thing?
The full course has two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed answer explanations.
Start my full course on Udemy →