Quiz: Applied Cryptography
A 25-question self-check covering TLS, cipher suites, VPNs, encryption at rest, and the certificate and key lifecycle. Several questions are tagged with the certification domain they map to — [Sec+] for CompTIA Security+ and [CISSP] for the (ISC)² CISSP. Answers and one-line explanations are at the end; try the whole quiz before checking.
Section 1 — Multiple choice (1 pt each)
1. [Sec+] Data moving across a network between two systems is best described as data: A. at rest B. in transit C. in use D. tokenized
2. [Sec+] The current version of TLS, defined in RFC 8446, is: A. TLS 1.0 B. TLS 1.1 C. TLS 1.2 D. TLS 1.3
3. In the TLS 1.3 handshake, the shared session key is established using: A. the server's long-term RSA private key directly B. ephemeral Diffie–Hellman key shares C. a pre-shared password D. the client's certificate
4. [Sec+] Forward secrecy guarantees that: A. future sessions are faster B. a future compromise of the server's long-term key cannot decrypt past recorded sessions C. certificates never expire D. the client is authenticated
5. [CISSP] Which cipher-suite component provides forward secrecy? A. AES_256_GCM B. SHA384 C. ECDHE (ephemeral key exchange) D. RSA authentication
6. A VPN primarily protects data: A. at rest on the disk B. in transit between the two tunnel endpoints C. inside the database D. after it leaves the far end of the tunnel
7. [Sec+] Full-disk encryption (BitLocker/LUKS) protects against: A. malware on a running, logged-in system B. a SQL-injection attack C. theft of a powered-off device D. a malicious database administrator
8. [CISSP] Replacing a card number with a non-sensitive surrogate stored in a separate vault, with no mathematical relationship to the original, is: A. encryption B. hashing C. tokenization D. salting
9. A device that generates and uses keys such that the private key never leaves it in plaintext is: A. a TPM-less laptop B. a Hardware Security Module (HSM) C. a CRL D. a load balancer
10. [Sec+] Mutual TLS (mTLS) differs from ordinary TLS in that: A. it uses a longer key B. both the client and the server authenticate with certificates C. it does not encrypt data D. it works only over a VPN
11. Which of these is a weak cipher or protocol a defender should disable? A. AES-256-GCM B. ChaCha20-Poly1305 C. RC4 D. ECDHE
12. [CISSP] Certificate Transparency (CT) primarily helps defenders: A. encrypt traffic faster B. detect certificates mis-issued for their own domains C. rotate disk keys D. replace OCSP
13. The least reliable part of the public-key infrastructure, often failing open, is: A. the handshake B. certificate revocation (CRL/OCSP) C. AES encryption D. the key exchange
14. [Sec+] WireGuard improves on typical IPsec configurations partly because it: A. supports more algorithms to choose from B. has no algorithm negotiation, removing downgrade and misconfiguration risk C. encrypts data at rest D. requires no keys
15. "Transparent Data Encryption is enabled, so a SQL-injection attacker running as the application cannot read cardholder data." This statement is: A. true B. false — TDE decrypts transparently for authorized queries, including the injected ones
Section 2 — True / False with justification (1 pt each)
For each, mark T or F and give a one-sentence reason.
16. "A server that offers AES-256-GCM is safe even if it also offers RC4."
17. [Sec+] "A VPN makes all traffic on the internal network encrypted end to end."
18. "Because TLS 1.3 removed weak cipher suites, you cannot accidentally configure a non-forward-secret suite in TLS 1.3."
19. "An expired certificate is a cryptographic weakness in AES or RSA."
20. "Storing a database's master encryption key in a file on the same server, readable by the database account, provides strong separation of key from data."
Section 3 — Fill in the blank (1 pt each)
21. The two states of data that auditors enforce protection for are data _ and data _.
22. [Sec+] In a cipher suite, the "E" in ECDHE stands for __, the property that provides forward secrecy.
23. The application-side defense in which a client refuses any certificate other than an expected one — even a validly signed one — is called certificate __.
Section 4 — Short answer (2 pts each)
24. [CISSP] Explain why a man-in-the-middle attack against well-configured TLS tends to surface as a certificate error rather than as silently decrypted traffic, and what control turns "the user sees an error" into "the attack is reliably stopped."
25. [Sec+] Meridian discovers a forgotten web service offering TLS 1.0 with a 3DES cipher suite and an expired certificate. (a) Name the three distinct findings. (b) For each, say whether it is a transport- protocol problem, a cipher problem, or a lifecycle problem. (c) State which one most urgently must change and why.