Examkin

Question

Difficulty: MediumCryptographic and Security Control Weaknesses

A security engineer auditing an enterprise cloud microservices environment identifies two specific architectural design choices: internal microservice-to-microservice traffic relies solely on network IP address allowlists without identity verification, and database backup files are encrypted using AES operating in Electronic Codebook (ECB) mode. Which of the following statements correctly describe the cryptographic and security control weaknesses present in this environment? (Select TWO.)

  1. Electronic Codebook (ECB) mode encrypts identical plaintext blocks into identical ciphertext blocks, preserving structural data patterns in the encrypted output.Answer
  2. Exclusive reliance on IP address allowlists relies on perimeter network location rather than cryptographic identity, violating Zero Trust continuous verification principles.Answer
  3. C
    Electronic Codebook (ECB) mode relies on asymmetric public key pairs for block encryption, creating significant key management overhead for bulk database backups.
  4. D
    IP address allowlisting functions as a corrective control that automates Certificate Signing Request (CSR) validation across public key infrastructure.

Answer

The weaknesses are that Electronic Codebook (ECB) mode reveals structural data patterns because identical plaintext blocks produce identical ciphertext blocks, and exclusive reliance on IP allowlists creates an outdated perimeter trust model that violates Zero Trust architecture principles.
The correct statements correctly identify the core weaknesses of ECB mode and implicit network trust. ECB mode encrypts identical plaintext blocks into identical ciphertext blocks because it lacks initialization vectors or chaining mechanism, exposing patterns in stored database files. Furthermore, relying solely on IP allowlists creates an implicit perimeter trust model, failing to enforce Zero Trust principles such as mutual TLS (mTLS) authentication and continuous verification.

Step-by-Step Solution

1
Analyze the cryptographic cipher mode flaw (AES-ECB).
Identified that ECB lacks initialization vectors and block chaining, meaning identical 128-bit plaintext blocks yield identical ciphertext blocks, leaking structural information.
Cryptographic modes like CBC or GCM must be used for confidentiality and data pattern hiding.
2
Analyze the access control weakness (IP allowlisting without mutual authentication).
Identified that trusting requests based on IP address alone assumes network position implies legitimacy.
Modern enterprise security requires Zero Trust architecture (ZTA) where identity is explicitly validated regardless of network location.

Key Concept

Cryptographic Block Cipher Modes and Zero Trust Access Control Weaknesses
Rate this question

Topics

Cryptographic and Security Control Weaknesses

More questions from this topic