General Security Concepts practice questions

Answer: A) Steganography

• ASteganography hides data inside another medium, such as an image, so the carrier looks innocent while concealing the payload.
• BTokenization replaces sensitive values with surrogate tokens stored in a vault; it doesn't hide data inside images.
• CMasking obscures parts of a value, such as showing only the last four digits; the data isn't hidden inside another file.
• DKey stretching strengthens password-derived keys; it isn't a way of concealing data inside other content.

Answer: A) A secure enclave

• AA secure enclave is an isolated processor environment that protects sensitive data and operations from the main OS.
• BAn HSM is a dedicated appliance or card for managing keys in servers, not a region inside a phone's processor.
• CA KMS is a service for generating, storing and rotating keys, usually centrally; it isn't on-chip isolation.
• DFDE encrypts storage at rest; it doesn't isolate data from a running, compromised OS.

Answer: A) The certificate is self-signed and does not chain to a trusted root CA

A certificate whose Issuer and Subject match is self-signed. Because it doesn't chain to a root CA in the browser's trust store, browsers warn that the issuer is untrusted even though the connection is encrypted.

• ACorrect. When Issuer and Subject match, the certificate signed itself. Browsers trust only certificates that chain to a CA root in their trust store, so a self-signed server certificate triggers an untrusted-issuer warning even though TLS still encrypts the session.
• BIncorrect. A missing intermediate can also cause an untrusted-issuer error. But then the Issuer field would name an intermediate CA, not the same name as the Subject.
• CIncorrect. Revocation produces a revoked-certificate error, not an untrusted-issuer warning. A certificate that signed itself also has no separate CA to revoke it.
• DIncorrect. A name mismatch produces a hostname or common-name mismatch warning. It does not report the issuer as untrusted, and it doesn't explain why the Issuer and Subject fields are identical.

Answer: A) It greatly increases brute-force resistance

• AEach extra bit doubles the key space, so a 256-bit key is vastly harder to brute-force.
• BKey length doesn't change whether an algorithm is symmetric or asymmetric.
• CLonger keys still need secure generation, storage and rotation.
• DPerformance impact varies by algorithm and hardware; it isn't a fixed halving.

Answer: A) Change management

• AFormal change management requires impact analysis, approval, a scheduled window, communication, and a documented rollback (backout) plan so changes are controlled and reversible.
• BIncident response handles active security events, not planned configuration changes.
• CBCP is about keeping the business running through disruptions, not approving routine changes.
• DPen testing probes for weaknesses; it isn't a change-approval workflow.

Answer: A) The certificate authority (CA) that issued the certificates

The issuing CA maintains the CRL of revoked serial numbers and publishes it to CRL distribution points. RAs, key escrow agents and OCSP responders have different roles.

• ACorrect. The issuing CA revokes certificates and publishes the CRL to its CRL distribution points on a configurable schedule. Relying parties check that the CRL's publisher matches the CA that issued the certificate.
• BIncorrect. An RA verifies identities and approves certificate requests for the CA. It does not sign or publish revocation lists.
• CIncorrect. Key escrow keeps copies of private keys so they can be recovered. It plays no role in revoking certificates or publishing revocation lists.
• DIncorrect. An OCSP responder answers real-time status queries about a specific certificate. It does not publish the CA's signed revocation list.

Answer: A) Transport encryption

• ATransport encryption, such as TLS, protects data in transit between endpoints.
• BFDE protects stored data on a disk, not data in transit.
• CDatabase encryption protects stored database contents, not network traffic.
• DFile-level encryption protects individual stored files.

Answer: A) Key escrow

• AKey escrow stores copies of keys with a trusted party so encrypted data remains recoverable when the normal keyholder is unavailable.
• BKey stretching makes a weak password harder to brute-force by running it through many hashing rounds; it doesn't preserve recoverability.
• CKey exchange is how two parties agree on a shared key, such as with Diffie-Hellman; it isn't about recovering lost keys.
• DPinning ties an application to a specific certificate or key to resist interception; it has nothing to do with key recovery.

Answer: A) Symmetric encryption is much faster

• AAsymmetric methods solve key exchange, but symmetric ciphers are far more efficient for bulk data.
• BSession keys must still be kept secret.
• CIt can, but it's too slow for large volumes of data.
• DCertificates are still used to authenticate the server.

Answer: A) A Subject Alternative Name (SAN) certificate listing the three hostnames

A SAN (multi-domain) certificate lists specific hostnames, so it covers exactly the three required names. A wildcard would cover every subdomain at that level, which is broader than required.

• AA SAN certificate lists each covered name explicitly, so one certificate protects exactly these three hostnames and nothing else.
• BA wildcard covers every subdomain at that level (for example login.example.com or test.example.com), so it is valid for far more names than required. That breaks the requirement to limit exposure.
• CThe apex domain does not include its subdomains, so a certificate for example.com alone would not match www, api, or shop.
• DCode-signing certificates prove who published software. They are not meant for authenticating TLS servers and would not secure HTTPS connections to these hosts.