CAS-002 · Question #13
A security audit has uncovered that some of the encryption keys used to secure the company B2B financial transactions with its partners may be too weak. The security administrator needs to implement…
The correct answer is C. PFS should be implemented on all VPN tunnels. Perfect Forward Secrecy (PFS) on VPN tunnels ensures that each session uses a unique ephemeral key pair (typically via Diffie-Hellman). If a long-term key is later found to be weak or compromised, PFS prevents an attacker from decrypting previously recorded sessions because…
Question
A security audit has uncovered that some of the encryption keys used to secure the company B2B financial transactions with its partners may be too weak. The security administrator needs to implement a process to ensure that financial transactions will not be compromised if a weak encryption key is found. Which of the following should the security administrator implement?
Options
- AEntropy should be enabled on all SSLv2 transactions.
- BAES256-CBC should be implemented for all encrypted data.
- CPFS should be implemented on all VPN tunnels.
- DPFS should be implemented on all SSH connections.
How the community answered
(13 responses)- A8% (1)
- B8% (1)
- C85% (11)
Explanation
Perfect Forward Secrecy (PFS) on VPN tunnels ensures that each session uses a unique ephemeral key pair (typically via Diffie-Hellman). If a long-term key is later found to be weak or compromised, PFS prevents an attacker from decrypting previously recorded sessions because each session key was independently derived and never stored. B2B financial transactions are typically conducted over VPN tunnels, making option C directly applicable. Option A is incorrect because SSLv2 is deprecated and insecure regardless of entropy. Option B (AES256-CBC) is a strong cipher but does not protect past sessions if the key is compromised. Option D applies PFS to SSH, which is not the primary channel for B2B financial transactions.
Topics
Community Discussion
No community discussion yet for this question.