CAS-002 · Question #112
Customer Need: "We need the system to produce a series of numbers with no discernible mathematical progression for use by our Java based, PKI-enabled, customer facing website." Which of the…
The correct answer is B. The system shall generate a pseudo-random number upon invocation by the existing Java. The customer requires a pseudo-random number generator invoked on demand by the existing Java application to produce unpredictable number sequences for the PKI-enabled customer-facing website.
Question
Customer Need:
"We need the system to produce a series of numbers with no discernible mathematical progression for use by our Java based, PKI-enabled, customer facing website." Which of the following BEST restates the customer need?
Options
- AThe system shall use a pseudo-random number generator seeded the same every time.
- BThe system shall generate a pseudo-random number upon invocation by the existing Java
- CThe system shall generate a truly random number based upon user PKI certificates.
- DThe system shall implement a pseudo-random number generator for use by corporate
How the community answered
(34 responses)- A9% (3)
- B85% (29)
- C3% (1)
- D3% (1)
Why each option
The customer requires a pseudo-random number generator invoked on demand by the existing Java application to produce unpredictable number sequences for the PKI-enabled customer-facing website.
Seeding a PRNG with the same value every time produces an identical, fully deterministic and predictable sequence, which directly contradicts the requirement for numbers with no discernible mathematical progression.
A PRNG invoked by the existing Java application generates unpredictable sequences on demand with no discernible mathematical progression, directly fulfilling the stated requirement while integrating with the Java-based, PKI-enabled architecture already in place - for example via Java's SecureRandom class.
PKI certificates are used for authentication and key exchange, not as entropy sources for random number generation; conflating PKI functionality with true randomness is technically inaccurate.
The customer requirement specifies a customer-facing website, not a corporate internal system, so restricting the PRNG to corporate use fails to address the stated deployment context.
Concept tested: Pseudo-random number generation for Java PKI-enabled applications
Source: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/security/SecureRandom.html
Topics
Community Discussion
No community discussion yet for this question.