Deck 8: Secure Programming With C and Openssl

Question 1

3)The strlen function should only be used when '\0' terminated string is guaranteed.

Answer 1

True

Question 2

12)Certificate revocation is done in OpenSSL by using the ca command with the -____ option.

A) remove
B) retire
C) revoke
D) crl

Answer 2

C

Question 3

6)C/C++ developers must do their own memory management using the standard APIs malloc(), alloc(), realloc(), free(), new() and ____ .

A) delete()
B) remove()
C) revoke()
D) erase()

Answer 3

A

Question 4

15)____ encoding is very useful when binary data needs to transfer correctly among platforms with different code pages over the Internet.

A) Base64
B) SHA1
C) MD5
D) RC4

Question 5

1)C is "close to the machine," as the abstractions the language introduced are readily grounded in the concrete data types and operations supplied by conventional computers

Question 6

4)As part of a shell program or batch program, OpenSSL commands are usually run in interactive mode.

Question 7

9)The OpenSSL command-line tool executable is called ____ on UNIX.

A) openssl.exe
B) openssl
C) cmdssl
D) opensslcmd

Question 8

20)____ is a popular software program that uses encryption techniques to encrypt and digitally sign e-mail.

A) PKCS
B) EVP
C) PGP
D) FIPS

Question 9

17)OpenSSL provides the APIs ____ for Base64 decoding.

A) EVP_DecodeBase64
B) EVP_B64Decode
C) EVP_Base64DecodeBlock
D) EVP_DecodeBlock

Question 10

2)Totally strong type checking is possible to achieve.

Question 11

19)____ is a symmetric block cipher designed in 1993 by Bruce Schneier as a fast, free alternative to existing encryption algorithms.

A) IDEA
B) AES
C) RC5
D) Blowfish

Question 12

11)The ____ command is a PKCS#10 certificate request and certificate generating utility.

A) cert
B) req
C) pkcs
D) pkcsreq

Question 13

14)OpenSSL provides a single API set that serves as an interface to all hashing and symmetric cryptography algorithms: the ____ interface.

A) SSL
B) EVP
C) Crypt
D) Security

Question 14

8)Buffer overflow provides the ability to overwrite a return address causing ____.

A) heap overruns
B) variable overruns
C) stack overruns
D) variable smashing

Question 15

7)A language is ____ typed if it enforces type abstractions where operations can be applied only to objects of the appropriate type.

A) weakly
B) virtually
C) securely
D) strongly

Question 16

5)OpenSSL contains a minimal CA application that ships with the toolkit.

Question 17

16)OpenSSL provides the APIs ____ for Base64 encoding.

A) EVP_B64EncodeBlock
B) EVP_Base64EncodeBlock
C) EVP_EncodeBlock
D) EVP_Base64Block

Question 18

13)The ____ option in the ca command is used to generate the CRL.

A) -gencrl
B) -crl
C) -revoke
D) -crlcert

Question 19

10)The OpenSSL command-line tool executable is called ____ on Windows.

A) openssl.bat
B) openssl.com
C) cmdssl.exe
D) openssl.exe

Question 20

18)____ is a symmetric key-encryption technique that will replace the commonly used DES standard.

A) AES
B) RC2
C) IDEA
D) Blowfish

Question 21

25)The standard organization ____ has been developing a standard for transport layer security based on SSL, and the result is TLS version 1.

A) IEFT
B) ACM
C) OSI
D) IEEE

Question 22

33)Why is it hard to write secure code with C?

Question 23

22)A ____ cipher is a symmetric cipher in which the input digits are encrypted one at a time.

A) block
B) group
C) bit
D) stream

Question 24

34)What causes a buffer overflow?

Question 25

29)____________________ is a specific type of stack overrun attack where the goal is to overwrite the return address of subroutines on the stack.

Question 26

28)One common buffer overflow attack is called the ____________________, where the target is to overwrite internal data of a program.

Question 27

35)Why are most high-level programming languages essentially immune to buffer overflow problems?

Question 28

36)Describe the memory arrangement of a C program.

Question 29

24)____ is a protocol that provides a secure channel between two systems.

A) AES
B) FIPS
C) SSL
D) EVP

Question 30

31)____________________ is the mathematical process that produces the message digest or "hash."

Question 31

37)What is the general algorithm for a stack overrun attack?

Question 32

39)How can you revoke a certificate in OpenSSL?

Question 33

38)Describe the structure of a configuration file for OpenSSL.

Question 34

40)How does hashing work?

Question 35

26)____ are usually used in conjunction with nonsecret parameters to derive one or more keys from a common secret value.

A) TLS
B) EVPs
C) KDFs
D) MACs

Question 36

30)The open source toolkit ____________________ is the de facto standard library for full-feature cryptography and SSL implementation for use with the C programming languages.

Question 37

21)____ is a block cipher designed by Xuejia Lai and James L. Massey in 1991.

A) AES
B) IDEA
C) Blowfish
D) RC4

Question 38

27)____________________ helps to insure the security and portability of the code, and it usually requires that the programmer explicitly define the types of each object in a program.

Question 39

41)What is the core path for hashing with EVP API?

Question 40

23)Most block ciphers are constructed by composing several simpler functions. These ciphers are called iterated block ciphers or ____ ciphers.

A) hybrid
B) product
C) stream
D) group

Question 42

42)Briefly describe DES and its variants.