Examkin

Soru

Zorluk: OrtaCryptographic Concepts and Algorithms

A security administrator is configuring a secure transmission channel for automated database synchronization between two enterprise data centers. The organization requires a cryptographic configuration that guarantees mutual identity authentication of both endpoint servers, session confidentiality with perfect forward secrecy (PFS), and payload integrity. Which of the following cryptographic mechanisms or protocols should the administrator select? (Select TWO.)

  1. Configure Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange during TLS session negotiationCevap
  2. Enforce Mutual TLS (mTLS) with dual-sided X.509 digital certificate validationCevap
  3. C
    Use static RSA key exchange to encrypt and transport the symmetric session keys
  4. D
    Encrypt all bulk database payloads directly using RSA-4096 asymmetric public key encryption
  5. E
    Generate MD5 message digests to verify record integrity across data streams

Cevap

The correct cryptographic mechanisms to implement are Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange for perfect forward secrecy and Mutual TLS (mTLS) with X.509 certificates for mutual authentication.
Implementing Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange provides dynamic, single-session keys that guarantee perfect forward secrecy. Pairing ECDHE with Mutual TLS (mTLS) ensures both database servers authenticate each other's identity using digital certificates prior to payload transmission.

Adım Adım Çözüm

1
Evaluate the requirement for session confidentiality with perfect forward secrecy (PFS).
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) generates temporary, single-session key pairs for each connection, ensuring past traffic remains secure even if long-term private keys are exposed.
Ephemeral Diffie-Hellman variants are necessary to fulfill PFS constraints.
2
Evaluate the requirement for mutual authentication between enterprise data center nodes.
Mutual TLS (mTLS) requires both the initiating server and receiving server to present X.509 certificates issued by a trusted Certificate Authority.
Standard TLS only authenticates the server to the client, whereas mTLS enforces bidirectional certificate verification.
3
Analyze and eliminate unsuitable cryptographic choices.
Static RSA key exchange lacks PFS, RSA asymmetric encryption is unsuitable for bulk data transfers due to performance overhead, and MD5 is cryptographically broken.
Cryptographic implementations must align cipher capabilities with specific operational performance and risk requirements.

Anahtar Kavram

Key Exchange Mechanisms and Authentication Protocols
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Cryptographic Concepts and Algorithms

Bu konudan daha fazla soru