Examkin

Question

Difficulty: Very hardCryptographic Concepts and Algorithms

An enterprise security team is designing a cryptographically secure real-time transaction processing engine for a distributed financial network. The system requires ephemeral key agreement for inter-microservice TLS communications to protect past sessions if long-term credentials are compromised, alongside high-speed data encryption with built-in authenticity verification for sensitive ledger entries stored in volatile memory. Which of the following cryptographic implementation choices should the security team select to satisfy these requirements? (Select TWO).

  1. Implement Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange for microservice transport sessions to provide Perfect Forward Secrecy.Answer
  2. Utilize Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) for in-memory ledger entry protection.Answer
  3. C
    Use RSA 4096-bit asymmetric encryption to encrypt in-memory ledger entry payloads prior to storage.
  4. D
    Apply standalone SHA-256 cryptographic hashing to outbound transaction messages to guarantee sender non-repudiation.
  5. E
    Deploy network-level web application firewall (WAF) filtering rules to address cryptographic cipher suite weaknesses.

Answer

The correct implementation choices are using Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for transport session key exchange and Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) for in-memory ledger protection.
Implementing Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) provides Perfect Forward Secrecy (PFS) by generating temporary keys for each TLS session, ensuring past communications remain secure even if long-term private keys are compromised later. Additionally, Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) is an authenticated symmetric encryption cipher mode (AEAD) optimized for high-throughput data protection, delivering both confidentiality and integrity verification.

Step-by-Step Solution

1
Analyze transport session privacy and key durability requirements
Identify that Perfect Forward Secrecy (PFS) via ephemeral key agreement (ECDHE) is required so future key compromises do not decrypt past traffic.
Static key exchange mechanisms reuse keys across sessions, whereas ephemeral Diffie-Hellman creates temporary keys per session.
2
Evaluate data protection requirements for high-throughput volatile memory storage
Select AES-GCM as an authenticated symmetric cipher providing high-speed confidentiality and built-in integrity tags.
Symmetric AEAD modes handle bulk data efficiently with cryptographic authenticity verification, unlike asymmetric algorithms which are too slow.
3
Differentiate cryptographic integrity vs non-repudiation and control scope
Reject standalone hashing for non-repudiation, asymmetric ciphers for bulk storage, and network firewalls for cipher suite remediation.
Non-repudiation requires private-key digital signatures, bulk storage demands symmetric encryption, and cipher suite weaknesses require protocol-level cryptographic configuration.

Key Concept

Cryptographic Algorithms, Cipher Modes, and Ephemeral Key Exchange
Rate this question

Topics

Cryptographic Concepts and Algorithms

More questions from this topic