Examkin

Soru

Zorluk: ZorCryptographic Concepts and Algorithms

A security engineer is configuring cryptographic primitives for a high-throughput financial microservice architecture. The system must establish session keys over untrusted networks ensuring Perfect Forward Secrecy (PFS), while also supporting high-speed authenticated bulk data encryption for payload storage. Which of the following cryptographic mechanisms should the engineer implement to satisfy BOTH requirements? (Select TWO.)

  1. Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchangeCevap
  2. Advanced Encryption Standard in Galois/Counter Mode (AES-GCM)Cevap
  3. C
    Static RSA key exchange using standard public/private key pairs
  4. D
    RSA asymmetric signatures with SHA-256 hashing for bulk payload encryption
  5. E
    PKCS#10 Certificate Signing Request (CSR) generation with CA root signing

Cevap

The engineer should select Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange for Perfect Forward Secrecy and Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) for high-speed authenticated bulk data encryption.
Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) generates temporary keys per session to ensure Perfect Forward Secrecy (PFS). Advanced Encryption Standard in Galois/Counter Mode (AES-GCM) is an authenticated symmetric encryption algorithm designed for high-performance bulk data confidentiality and integrity.

Adım Adım Çözüm

1
Analyze the requirement for Perfect Forward Secrecy (PFS) during session key negotiation.
Identify that ephemeral key exchange algorithms like ECDHE generate unique, disposable session keys that prevent past sessions from being decrypted if long-term private keys are compromised.
Static asymmetric methods like traditional RSA key exchange do not support ephemeral keying.
2
Analyze the requirement for high-speed authenticated bulk payload encryption.
Identify symmetric block ciphers operating in authenticated encryption modes, specifically AES-GCM, which offer hardware-accelerated confidentiality and built-in integrity checking.
Asymmetric encryption and digital signature algorithms are computationally intensive and unsuitable for bulk payload confidentiality.
3
Select the correct combination of cryptographic primitives based on operational requirements.
Choose ECDHE for session key establishment and AES-GCM for bulk payload protection.
These mechanisms satisfy both PFS and high-speed authenticated encryption needs directly.

Anahtar Kavram

Cryptographic Algorithms and Key Exchange Properties
Bu soruyu puanla

Konular

Cryptographic Concepts and Algorithms

Bu konudan daha fazla soru