Free 212-81V3 sample questions

Correct answers: Rainbow table attack; Time-memory trade-off attack

Rainbow tables are a specific type of precomputed lookup table used to reverse cryptographic hash functions, typically for cracking password hashes. They are highly effective against unsalted hashes like the ones described.

A rainbow table attack is a classic example of a time-memory trade-off attack. It uses a large amount of storage (memory) to precompute hash chains, which significantly reduces the time required to crack each individual password compared to a brute-force attack.

Correct answer: False

False. The primary purpose of the S-box is to provide **confusion**, which obscures the relationship between the key and the ciphertext. **Diffusion**, which spreads the influence of a single plaintext bit over many ciphertext bits, is primarily provided by the P-box (Permutation-box) in ciphers like DES.

Correct answer: CRYSTALS-Kyber

CRYSTALS-Kyber is a lattice-based Key Encapsulation Mechanism (KEM) that NIST has selected as the primary standard for general-purpose public-key encryption and key establishment in the post-quantum era. CRYSTALS-Dilithium and SPHINCS+ are digital signature algorithms, not KEMs.

Correct answer: 4096

In the `openssl genrsa` command, the number of bits for the key size is specified as the last argument without any preceding flag. Therefore, `4096` is the correct value to complete the command.

Correct answer: Mono-alphabetic substitution cipher

A mono-alphabetic substitution cipher uses a fixed substitution over the entire message. This preserves the underlying frequency distribution of the original language, making it vulnerable to frequency analysis, as described in the scenario. The Caesar and Atbash ciphers are specific examples of this type.

Correct answer: Tunnel Mode

IPsec Tunnel Mode encrypts the entire original IP packet (header and payload) and encapsulates it within a new IP packet. This is ideal for site-to-site VPNs as it hides the internal network addressing. Transport Mode, in contrast, only encrypts the payload of the original packet, leaving the original IP header intact.

Correct answer: MD5

The MD5 algorithm has been cryptographically broken and is known to have practical collision attacks, meaning different inputs can be found that produce the same hash value. For applications requiring collision resistance, such as digital signatures, MD5 is considered insecure and should not be used. SHA-256, SHA-3, and BLAKE2 are all considered secure alternatives.

Correct answer: It provides the same level of security with smaller key sizes.

The main advantage of ECC over RSA is that it offers equivalent cryptographic strength with much smaller key sizes. For example, a 256-bit ECC key provides comparable security to a 3072-bit RSA key. This results in faster computations, lower power consumption, and reduced storage and bandwidth requirements, making ECC ideal for mobile and IoT devices.

Correct answer: The client does not have the private CA's root certificate in its trust store.

For a TLS connection to be established, the client must trust the Certificate Authority that issued the server's certificate. In the case of a private CA, the CA's root certificate is not included in the default trust stores of browsers and operating systems. The client cannot validate the server's certificate chain back to a trusted root, causing the handshake to fail. The solution is to install the private CA's root certificate into the client's trust store.

Correct answer: Web of Trust

The Web of Trust is a decentralized trust model used by PGP. Unlike the hierarchical model of X.509 PKI that relies on CAs, the Web of Trust allows any user to sign another user's public key certificate, vouching for the association between that public key and the person or entity listed on it. Trust is established based on these interconnected endorsements.