Examkin

Soru

Zorluk: OrtaCryptographic and Security Control Weaknesses

A security team is conducting a technical audit of an organization's network and application infrastructure. Match each identified cryptographic or security control weakness on the left with the precise risk or impact it presents on the right.

  • Disabling Certificate Revocation List (CRL) and OCSP validation checks on client systemsContinued acceptance of revoked digital certificates, permitting unauthorized server authentication
  • Configuring block ciphers using Cipher Block Chaining (CBC) mode with static, predictable Initialization VectorsVulnerability to ciphertext pattern analysis and replay attacks due to non-randomized initial encryption states
  • Deploying Diffie-Hellman Key Exchange configured with a 1024-bit prime group (Group 2)Susceptibility to man-in-the-middle (MitM) decryption via offline precomputation attacks against weak key negotiation parameters
  • Embedding static API secret keys directly into compiled client-side mobile application codeUniversal credential compromise across all deployments via binary reverse-engineering

Cevap

The correct pairings match each specific cryptographic weakness to its primary security consequence: Disabling CRL/OCSP checking leads to acceptance of revoked certificates; static IVs in CBC mode allow pattern recognition and replay attacks; 1024-bit DH Group 2 allows session decryption through precomputation attacks; hardcoded API keys in client binaries lead to universal key exposure via reverse engineering.
Each weakness is paired with its direct operational impact: Disabling revocation checks allows revoked certificates to be accepted; using static IVs in CBC mode compromises semantic security, enabling pattern leakage; using 1024-bit DH groups permits key exchange cracking via precomputation; hardcoding secret keys allows binary reverse-engineering to expose credentials universally.

Adım Adım Çözüm

1
Analyze the impact of ignoring certificate revocation status (CRL/OCSP).
Identify that revoked or compromised certificates will still be trusted by the system.
Revocation validation guarantees that certificates invalidated before their planned expiration date are rejected.
2
Evaluate the mathematical requirement for Initialization Vectors in CBC block cipher mode.
Determine that static or predictable IVs leak information about plaintext patterns.
CBC mode requires unpredictable IVs to ensure identical plaintext blocks produce distinct ciphertext blocks.
3
Assess the cryptographic strength of 1024-bit Diffie-Hellman Key Exchange (Group 2).
Connect low key sizes to vulnerability against precomputation-based MitM attacks.
1024-bit modulus sizes offer insufficient security against modern discrete logarithm precomputation algorithms.
4
Examine the security implications of embedding secret keys within distributed client code.
Recognize that static secrets in client binaries can be extracted through reverse-engineering.
Client applications operate on untrusted hardware where binary disassembly can easily reveal hardcoded secrets.

Anahtar Kavram

Cryptographic and Security Control Weaknesses
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Cryptographic and Security Control Weaknesses

Bu konudan daha fazla soru