1. What is the primary purpose of a cryptographic hash function?
A) Encrypting data for secure transmission
B) Ensuring data confidentiality
C) Ensuring data integrity and authentication
D) Generating random numbers
✅ Answer: C) Ensuring data integrity and authentication
📖 Explanation: Hash functions create a unique fixed-size digest from input data, ensuring data integrity. Any change in input results in a different hash, allowing integrity verification.
2. Which of the following properties is NOT a characteristic of a secure hashing algorithm?
A) Deterministic output
B) Collision resistance
C) Reversibility
D) Avalanche effect
✅ Answer: C) Reversibility
📖 Explanation: A secure hash function must be one-way and irreversible. Reversibility would make it vulnerable to attacks.
3. Which hashing algorithm produces a 160-bit hash value?
A) MD5
B) SHA-1
C) SHA-256
D) Blake2
✅ Answer: B) SHA-1
📖 Explanation: SHA-1 generates a 160-bit digest. However, it is considered insecure due to collision vulnerabilities.
4. Which of the following is a significant weakness of the MD5 algorithm?
A) High computational cost
B) Slow performance
C) Collision vulnerability
D) Lack of determinism
✅ Answer: C) Collision vulnerability
📖 Explanation: MD5 is insecure because attackers can generate the same hash for different inputs, making it unsuitable for cryptographic security.
5. What is the purpose of a “salt” in password hashing?
A) To slow down brute-force attacks
B) To make hash values longer
C) To increase computational speed
D) To allow password recovery
✅ Answer: A) To slow down brute-force attacks
📖 Explanation: A salt is a random value added to passwords before hashing, ensuring that even identical passwords have unique hash values.
6. Which of the following hashing algorithms is considered the most secure?
A) SHA-1
B) MD5
C) SHA-256
D) CRC32
✅ Answer: C) SHA-256
📖 Explanation: SHA-256 is part of the SHA-2 family, widely used in secure applications like Bitcoin and TLS encryption.
7. What is a “collision” in the context of hashing algorithms?
A) When two hash functions operate simultaneously
B) When two different inputs produce the same hash
C) When a hash function outputs a different length
D) When hashing takes too long to compute
✅ Answer: B) When two different inputs produce the same hash
📖 Explanation: A collision occurs when two distinct inputs result in the same hash, compromising the function’s security.
8. Why is SHA-3 different from SHA-2?
A) SHA-3 is based on the Keccak algorithm
B) SHA-3 is faster than SHA-2
C) SHA-3 produces a fixed-length output
D) SHA-3 is reversible
✅ Answer: A) SHA-3 is based on the Keccak algorithm
📖 Explanation: Unlike SHA-2, which is based on the Merkle-Damgård structure, SHA-3 uses the Keccak sponge construction, offering higher security.
9. Which of the following is NOT a valid cryptographic hash function?
A) SHA-512
B) MD6
C) Whirlpool
D) AES
✅ Answer: D) AES
📖 Explanation: AES is a symmetric encryption algorithm, not a hash function.
10. What is the ideal property of a cryptographic hash function regarding the “avalanche effect”?
A) Small input changes should result in large output changes
B) Output should remain similar for minor input changes
C) It should generate a reversible hash
D) The hash should be unique for numbers only
✅ Answer: A) Small input changes should result in large output changes
📖 Explanation: The avalanche effect ensures that even a single-bit change in input significantly alters the hash output, improving security.
11. Which of the following attacks exploits weak hash functions?
A) Birthday attack
B) Side-channel attack
C) Brute-force attack
D) SQL injection
✅ Answer: A) Birthday attack
📖 Explanation: The birthday paradox increases the likelihood of collisions, making weak hash functions vulnerable.
12. What is the output length of SHA-512?
A) 128-bit
B) 256-bit
C) 384-bit
D) 512-bit
✅ Answer: D) 512-bit
📖 Explanation: SHA-512 produces a 512-bit hash, making it more resistant to brute-force attacks.
13. Which of the following hashing functions is best suited for password storage?
A) SHA-256
B) MD5
C) PBKDF2
D) SHA-1
✅ Answer: C) PBKDF2
📖 Explanation: PBKDF2, bcrypt, and Argon2 are designed for password hashing because they use key stretching to slow down brute-force attacks.
14. What is the main purpose of HMAC (Hashed Message Authentication Code)?
A) To encrypt messages securely
B) To ensure message integrity and authenticity
C) To speed up hash computation
D) To decrypt hashed messages
✅ Answer: B) To ensure message integrity and authenticity
📖 Explanation: HMAC combines hashing with a secret key to prevent tampering and forgery.
15. Which hashing algorithm is commonly used in blockchain technology?
A) SHA-1
B) SHA-256
C) MD5
D) DES
✅ Answer: B) SHA-256
📖 Explanation: Bitcoin and other cryptocurrencies use SHA-256 for proof-of-work mining and transaction integrity.
16. How can an attacker reverse a hash?
A) Using a brute-force attack
B) Using hash reversal algorithms
C) By decrypting it with a key
D) By using the hash function in reverse
✅ Answer: A) Using a brute-force attack
📖 Explanation: Since hash functions are one-way, reversing a hash requires brute-force or rainbow table attacks.
17. What is a rainbow table attack?
A) A brute-force attack using precomputed hashes
B) A network sniffing attack
C) A hash function optimization technique
D) A DoS attack on hash computations
✅ Answer: A) A brute-force attack using precomputed hashes
📖 Explanation: Rainbow tables store precomputed hash values for faster password cracking.
18. What happens when hashing the same input multiple times?
A) The output hash changes every time
B) The output remains the same
C) The hash length increases
D) It depends on the algorithm
✅ Answer: B) The output remains the same
📖 Explanation: Hash functions are deterministic, meaning the same input always produces the same output.
19. Which hashing algorithm is used in digital signatures?
A) SHA-256
B) MD4
C) AES-128
D) Blowfish
✅ Answer: A) SHA-256
📖 Explanation: SHA-256 is commonly used with RSA, DSA, and ECDSA in digital signatures.
20. Which hashing algorithm is considered resistant to quantum computing attacks?
A) SHA-1
B) SHA-2
C) SHA-3
D) MD5
✅ Answer: C) SHA-3
📖 Explanation: SHA-3 has a different structure that makes it more resistant to quantum computing threats.
21. Which characteristic ensures that even a small change in input drastically changes the hash output?
A) Determinism
B) Pre-image resistance
C) Avalanche effect
D) Key stretching
✅ Answer: C) Avalanche effect
📖 Explanation: The avalanche effect ensures that a minor input change causes a major output difference, increasing security.
22. What is the primary difference between SHA-256 and SHA-512?
A) SHA-512 is faster than SHA-256
B) SHA-256 has a larger hash output than SHA-512
C) SHA-512 generates a longer hash value than SHA-256
D) SHA-512 uses a different hash function than SHA-256
✅ Answer: C) SHA-512 generates a longer hash value than SHA-256
📖 Explanation: SHA-512 produces a 512-bit hash, while SHA-256 produces a 256-bit hash, making SHA-512 more resistant to brute-force attacks.
23. Which of the following hash functions was designed to be quantum-resistant?
A) MD5
B) SHA-3
C) SHA-1
D) Whirlpool
✅ Answer: B) SHA-3
📖 Explanation: SHA-3 uses the Keccak sponge construction, making it more resistant to quantum attacks.
24. What is the primary advantage of bcrypt over traditional hashing algorithms like SHA-256?
A) Bcrypt generates shorter hash values
B) Bcrypt is slower and resistant to brute-force attacks
C) Bcrypt uses asymmetric encryption
D) Bcrypt is reversible
✅ Answer: B) Bcrypt is slower and resistant to brute-force attacks
📖 Explanation: Bcrypt is designed to be computationally expensive, slowing down brute-force attacks.
25. Which cryptographic hash function is NOT susceptible to length extension attacks?
A) MD5
B) SHA-1
C) SHA-256
D) SHA-3
✅ Answer: D) SHA-3
📖 Explanation: SHA-3 does not use the Merkle-Damgård construction, making it resistant to length extension attacks.
26. What is the main weakness of SHA-1?
A) It generates a very large hash value
B) It is computationally expensive
C) It is vulnerable to collision attacks
D) It cannot be implemented in software
✅ Answer: C) It is vulnerable to collision attacks
📖 Explanation: SHA-1 has been broken due to discovered collision vulnerabilities, making it unsuitable for cryptographic security.
27. How does Argon2 improve security over traditional hashing methods?
A) By being faster than MD5
B) By reducing hash collisions
C) By being memory-hard, making brute-force attacks expensive
D) By allowing hash reversal for security audits
✅ Answer: C) By being memory-hard, making brute-force attacks expensive
📖 Explanation: Argon2 uses high memory consumption to resist GPU-based brute-force attacks.
28. Which hashing algorithm is commonly used for digital certificates?
A) SHA-1
B) SHA-256
C) MD5
D) AES
✅ Answer: B) SHA-256
📖 Explanation: SHA-256 is widely used in TLS certificates and digital signatures for security.
29. What makes a cryptographic hash function suitable for password hashing?
A) High speed
B) Deterministic output
C) Salt and key stretching support
D) Reversible computation
✅ Answer: C) Salt and key stretching support
📖 Explanation: Salting and key stretching (e.g., in bcrypt and Argon2) enhance security by making brute-force attacks harder.
30. Which type of hashing attack exploits weaknesses in checksum algorithms?
A) Rainbow table attack
B) Collision attack
C) Length extension attack
D) Birthday attack
✅ Answer: B) Collision attack
📖 Explanation: Collision attacks attempt to find two different inputs producing the same hash, breaking security.
31. Why is SHA-256 still widely used despite the existence of SHA-3?
A) SHA-3 is not secure
B) SHA-256 is more computationally efficient
C) SHA-3 is too slow for cryptographic use
D) SHA-256 supports reversible hashing
✅ Answer: B) SHA-256 is more computationally efficient
📖 Explanation: SHA-256 is faster and widely adopted in blockchain, TLS, and authentication, making migration to SHA-3 slower.
32. What is a key derivation function (KDF) used for?
A) Encrypting sensitive data
B) Slowing down brute-force password attacks
C) Generating secure random numbers
D) Compressing hash outputs
✅ Answer: B) Slowing down brute-force password attacks
📖 Explanation: KDFs (like PBKDF2, bcrypt, Argon2) make password hashing computationally expensive to resist brute-force attacks.
33. Why is MD5 still used despite being broken?
A) It is the most secure hashing algorithm
B) It is required for digital signatures
C) It is fast and used for non-cryptographic checksums
D) It cannot be replaced
✅ Answer: C) It is fast and used for non-cryptographic checksums
📖 Explanation: MD5 is insecure for cryptography but still used in file integrity checks where security is not a concern.
34. What is a primary security concern when hashing small amounts of data?
A) Hash collisions become more likely
B) The output is too large
C) The hash cannot be stored securely
D) The hash takes too long to compute
✅ Answer: A) Hash collisions become more likely
📖 Explanation: With limited input size, collisions become more frequent, weakening security.
35. What hashing technique is used in Zero-Knowledge Proofs (ZKPs)?
A) MD5
B) SHA-256
C) Pedersen hash
D) CRC32
✅ Answer: C) Pedersen hash
📖 Explanation: Pedersen hashing is used in zero-knowledge proofs due to its homomorphic properties.
36. Why are hash-based message authentication codes (HMACs) secure?
A) They use symmetric encryption
B) They require a secret key in addition to hashing
C) They generate reversible hashes
D) They allow hash collisions
✅ Answer: B) They require a secret key in addition to hashing
📖 Explanation: HMACs use a secret key with hashing to ensure message integrity and authenticity.
37. Which hashing algorithm was designed as an alternative to SHA-2?
A) Tiger
B) RIPEMD-160
C) SHA-3
D) MD6
✅ Answer: C) SHA-3
📖 Explanation: SHA-3 was developed as a post-SHA-2 alternative, providing higher security using the Keccak sponge function.
38. Which hashing function is often used in digital forensics to verify file integrity?
A) AES
B) MD5
C) SHA-256
D) HMAC
✅ Answer: C) SHA-256
📖 Explanation: SHA-256 is used in digital forensics to verify that a file has not been altered.
39. What is the key feature of a cryptographic hash used in password storage?
A) High speed
B) Reversible computation
C) Computational cost (work factor)
D) Symmetric key requirement
✅ Answer: C) Computational cost (work factor)
📖 Explanation: Secure password hashing algorithms are slow to make brute-force attacks infeasible.
40. What is the most secure hashing algorithm for modern cryptographic applications?
A) MD5
B) SHA-1
C) SHA-256
D) Argon2
✅ Answer: D) Argon2
📖 Explanation: Argon2 is the most secure password hashing algorithm, offering memory-hardness and resistance to brute-force attacks.
41. Which of the following hashing algorithms produces the shortest hash output?
A) SHA-256
B) MD5
C) SHA-1
D) SHA-512
✅ Answer: B) MD5
📖 Explanation: MD5 produces a 128-bit hash, while SHA-1 generates 160-bit, SHA-256 generates 256-bit, and SHA-512 produces 512-bit hashes.
42. What is the primary weakness of using unsalted hashes for password storage?
A) They increase hash computation time
B) They are easily reversible
C) They allow attackers to use precomputed hash tables (rainbow tables)
D) They generate unpredictable outputs
✅ Answer: C) They allow attackers to use precomputed hash tables (rainbow tables)
📖 Explanation: Salts prevent rainbow table attacks by making each hash unique, even if passwords are the same.
43. Which of the following best describes a key-stretching function?
A) A function that makes password hashing computationally expensive
B) A function that increases the length of the hash output
C) A function that compresses hash values
D) A function that enables reversible hashing
✅ Answer: A) A function that makes password hashing computationally expensive
📖 Explanation: Key-stretching functions (e.g., PBKDF2, bcrypt, Argon2) slow down brute-force attacks by making hash computations more difficult.
44. Which attack exploits weaknesses in hash functions to generate two different inputs with the same hash?
A) Rainbow table attack
B) Length extension attack
C) Collision attack
D) Side-channel attack
✅ Answer: C) Collision attack
📖 Explanation: Collision attacks occur when two different inputs produce the same hash, breaking the uniqueness property of the hash function.
45. Why is SHA-256 widely used in blockchain applications?
A) It is the fastest hash algorithm available
B) It allows for easy hash reversal
C) It provides strong cryptographic security and resistance to attacks
D) It generates the smallest hash output
✅ Answer: C) It provides strong cryptographic security and resistance to attacks
📖 Explanation: SHA-256 offers collision resistance and computational efficiency, making it ideal for blockchain security.
46. What makes a hash function pre-image resistant?
A) It generates small hash values
B) It is designed to prevent finding the original input from its hash
C) It allows quick hash computation
D) It ensures the same output for different inputs
✅ Answer: B) It is designed to prevent finding the original input from its hash
📖 Explanation: Pre-image resistance ensures that a hash cannot be reversed to determine the original input.
47. Which of the following is NOT a requirement for a cryptographic hash function?
A) It must be deterministic
B) It must allow easy hash reversal
C) It must be collision-resistant
D) It must produce a fixed-length output
✅ Answer: B) It must allow easy hash reversal
📖 Explanation: Cryptographic hash functions must be one-way functions, meaning they cannot be reversed.
48. What is a major advantage of SHA-3 over SHA-2?
A) It is significantly faster
B) It is based on a different cryptographic structure (Keccak sponge construction)
C) It generates shorter hash values
D) It requires less computational power
✅ Answer: B) It is based on a different cryptographic structure (Keccak sponge construction)
📖 Explanation: SHA-3 uses the Keccak sponge construction, which is more resistant to certain types of cryptographic attacks.
49. Which of the following hashing algorithms is NOT considered secure for cryptographic use?
A) MD5
B) SHA-256
C) Blake2
D) SHA-512
✅ Answer: A) MD5
📖 Explanation: MD5 is vulnerable to collision attacks and is not recommended for cryptographic security.
50. What is a pepper in password hashing?
A) A secret value added to passwords before hashing, stored separately from the hash
B) A type of cryptographic salt
C) A key used to encrypt hashed passwords
D) A hash function optimization method
✅ Answer: A) A secret value added to passwords before hashing, stored separately from the hash
📖 Explanation: A pepper is a secret key used alongside hashing and salting to further protect password storage.
51. Which algorithm is considered the successor to bcrypt for password hashing?
A) SHA-3
B) Argon2
C) SHA-512
D) Whirlpool
✅ Answer: B) Argon2
📖 Explanation: Argon2 is the recommended successor to bcrypt because it is memory-hard, making brute-force attacks more difficult.
52. Why is a hash function’s output size important in cryptographic security?
A) Larger hash sizes reduce the risk of collisions
B) Smaller hash sizes improve security
C) Output size determines how fast a hash can be reversed
D) Larger hash sizes improve brute-force attack speeds
✅ Answer: A) Larger hash sizes reduce the risk of collisions
📖 Explanation: A larger hash size reduces the probability of two different inputs producing the same hash.
53. Which hashing algorithm is best for digital forensics to ensure file integrity?
A) SHA-256
B) MD5
C) AES
D) DES
✅ Answer: A) SHA-256
📖 Explanation: SHA-256 is widely used in forensic analysis to verify file integrity without tampering.
54. What makes a hash function resistant to second pre-image attacks?
A) The ability to hash large files
B) The inability to find a different input with the same hash
C) Fast computation speed
D) Use of symmetric keys
✅ Answer: B) The inability to find a different input with the same hash
📖 Explanation: Second pre-image resistance ensures that an attacker cannot find a different input that results in the same hash.
55. Which hashing algorithm is used in Bitcoin mining?
A) MD5
B) SHA-256
C) SHA-1
D) Blake2
✅ Answer: B) SHA-256
📖 Explanation: Bitcoin uses SHA-256 in its proof-of-work algorithm to maintain blockchain security.
56. Which of the following describes a length extension attack?
A) An attack where additional data is appended to a hashed message without knowing the original data
B) A brute-force attack against long hashes
C) A method to extend hash computation time
D) A technique to shorten hash outputs
✅ Answer: A) An attack where additional data is appended to a hashed message without knowing the original data
📖 Explanation: Length extension attacks allow an attacker to extend a hash without knowing the original data, making some hash functions vulnerable.
57. Why is PBKDF2 considered secure for password hashing?
A) It uses multiple iterations to slow down brute-force attacks
B) It allows quick hash computation
C) It generates a random salt for every password
D) It produces the shortest hash possible
✅ Answer: A) It uses multiple iterations to slow down brute-force attacks
📖 Explanation: PBKDF2 increases computational time by applying multiple iterations, making brute-force attacks slower.
58. What is the primary advantage of Blake2 over SHA-2?
A) Faster performance with similar security levels
B) Uses shorter hash outputs
C) Requires less memory
D) Is based on the Merkle-Damgård construction
✅ Answer: A) Faster performance with similar security levels
📖 Explanation: Blake2 is faster than SHA-2 while maintaining similar cryptographic security.
59. Which hashing algorithm is widely used in Linux for file integrity verification?
A) SHA-1
B) MD5
C) SHA-512
D) SHA-256
✅ Answer: D) SHA-256
📖 Explanation: Many Linux systems use SHA-256 for integrity verification (e.g., file checksums).
60. Which algorithm is preferred for hashing large data structures efficiently?
A) SHA-1
B) SHA-3
C) Whirlpool
D) Blake2
✅ Answer: D) Blake2
📖 Explanation: Blake2 is optimized for hashing large data while maintaining high security.
61. Which of the following is NOT a property of a secure hash function?
A) Pre-image resistance
B) Collision resistance
C) Reversibility
D) Second pre-image resistance
✅ Answer: C) Reversibility
📖 Explanation: A secure hash function must be one-way and irreversible, meaning the original input cannot be derived from the hash.
62. What does the term “work factor” refer to in hashing algorithms?
A) The number of operations needed to compute a hash
B) The randomness of the hash output
C) The efficiency of the hash function in encryption
D) The number of hash collisions found in a given dataset
✅ Answer: A) The number of operations needed to compute a hash
📖 Explanation: The work factor determines how much computation is required, making brute-force attacks more difficult.
63. Why is SHA-1 deprecated for use in security applications?
A) It produces a short hash output
B) It is computationally expensive
C) It is vulnerable to collision attacks
D) It is too slow for modern systems
✅ Answer: C) It is vulnerable to collision attacks
📖 Explanation: SHA-1 has been broken due to successful collision attacks, making it unsafe for cryptographic security.
64. What is the main purpose of using a cryptographic hash in digital signatures?
A) To encrypt the message for confidentiality
B) To verify the integrity and authenticity of the message
C) To generate a symmetric encryption key
D) To make messages unreadable
✅ Answer: B) To verify the integrity and authenticity of the message
📖 Explanation: Hash functions ensure data integrity by allowing verification that the message has not been altered.
65. Which hashing function is optimized for password hashing and is recommended by security experts?
A) SHA-512
B) Argon2
C) Blake2
D) SHA-3
✅ Answer: B) Argon2
📖 Explanation: Argon2 is a memory-hard function specifically designed for secure password hashing, making brute-force attacks harder.
66. What is a hash collision?
A) When two different hash functions generate the same hash
B) When two different inputs produce the same hash
C) When a hash function fails to generate an output
D) When two hash functions cancel each other out
✅ Answer: B) When two different inputs produce the same hash
📖 Explanation: A collision occurs when two distinct inputs result in the same hash output, breaking the uniqueness property.
67. Which of the following is the primary reason SHA-3 was introduced?
A) To replace SHA-2 due to major vulnerabilities
B) To provide an alternative cryptographic structure
C) To generate shorter hash outputs
D) To reduce hash computation time
✅ Answer: B) To provide an alternative cryptographic structure
📖 Explanation: SHA-3 was developed as an alternative to SHA-2, using the Keccak sponge construction, offering stronger security in certain scenarios.
68. Which hashing algorithm is designed to be quantum-resistant?
A) SHA-256
B) MD5
C) SHA-3
D) SHA-1
✅ Answer: C) SHA-3
📖 Explanation: SHA-3 is designed to be more resistant to quantum computing attacks than traditional hash functions.
69. What is the major disadvantage of using a slow hash function for general data integrity checks?
A) Increased processing time
B) Reduced security
C) Hash collisions occur more frequently
D) Hash values become unpredictable
✅ Answer: A) Increased processing time
📖 Explanation: Slow hash functions (e.g., bcrypt, Argon2) increase security for password hashing but are not ideal for general data integrity verification due to performance costs.
70. Which of the following algorithms is NOT recommended for password hashing?
A) bcrypt
B) SHA-256
C) PBKDF2
D) Argon2
✅ Answer: B) SHA-256
📖 Explanation: SHA-256 is a general-purpose cryptographic hash and does not have built-in features like salting and key stretching that are necessary for secure password hashing.
71. What type of attack is mitigated by using salted hashes?
A) Brute-force attacks
B) Dictionary attacks
C) Rainbow table attacks
D) All of the above
✅ Answer: D) All of the above
📖 Explanation: Salting passwords makes them unique even if they are identical, preventing rainbow table and dictionary attacks, and increasing brute-force resistance.
72. What property ensures that even the slightest change in input drastically changes the hash output?
A) Determinism
B) Avalanche effect
C) Key stretching
D) Hash expansion
✅ Answer: B) Avalanche effect
📖 Explanation: The avalanche effect ensures that a small input change results in a significantly different hash, improving security.
73. Which of the following is a property of a hash function that makes it difficult to reverse-engineer?
A) Pre-image resistance
B) Reversible computation
C) Symmetric encryption
D) Computational simplicity
✅ Answer: A) Pre-image resistance
📖 Explanation: Pre-image resistance makes it computationally infeasible to determine the original input from its hash.
74. What is a primary reason for using SHA-256 over MD5?
A) SHA-256 generates shorter hashes
B) SHA-256 is faster than MD5
C) SHA-256 is more resistant to collision attacks
D) SHA-256 allows for easy decryption
✅ Answer: C) SHA-256 is more resistant to collision attacks
📖 Explanation: SHA-256 is significantly more secure than MD5 due to its larger hash size and resistance to collision attacks.
75. What is the primary use case for HMAC (Hashed Message Authentication Code)?
A) Secure password hashing
B) Verifying the integrity and authenticity of messages
C) Encrypting data
D) Speeding up hashing operations
✅ Answer: B) Verifying the integrity and authenticity of messages
📖 Explanation: HMAC combines hashing with a secret key to ensure data integrity and authentication.
76. What is the biggest drawback of using MD5 for data integrity verification?
A) It produces very large hash values
B) It is computationally slow
C) It is vulnerable to hash collisions
D) It cannot be implemented in software
✅ Answer: C) It is vulnerable to hash collisions
📖 Explanation: MD5 is highly vulnerable to collisions, meaning different inputs can produce the same hash, making it unreliable for integrity verification.
77. Which cryptographic function is commonly used in password managers for securely storing passwords?
A) Argon2
B) SHA-1
C) DES
D) RSA
✅ Answer: A) Argon2
📖 Explanation: Argon2 is specifically designed for secure password hashing and is widely used in password managers.
78. Which hash function is best suited for verifying large data integrity checks?
A) MD5
B) SHA-3
C) SHA-256
D) CRC32
✅ Answer: C) SHA-256
📖 Explanation: SHA-256 is widely used in data integrity verification (e.g., checksums, file verification) due to its collision resistance.
79. What does the term “salting” mean in password hashing?
A) Encrypting the hash output
B) Appending a random value to passwords before hashing
C) Hashing passwords twice for extra security
D) Using a fixed secret key with hashing
✅ Answer: B) Appending a random value to passwords before hashing
📖 Explanation: Salting passwords ensures that even identical passwords generate unique hashes, preventing attacks like rainbow tables.
80. Why is SHA-512 considered more secure than SHA-256?
A) It is faster than SHA-256
B) It generates longer hash outputs, making brute-force attacks harder
C) It requires less computational power
D) It is used in encryption instead of hashing
✅ Answer: B) It generates longer hash outputs, making brute-force attacks harder
📖 Explanation: SHA-512 produces a longer hash (512-bit) than SHA-256 (256-bit), making it more resistant to brute-force attacks.
81. Which of the following hash functions belongs to the SHA-2 family?
A) MD5
B) SHA-1
C) SHA-256
D) RIPEMD-160
✅ Answer: C) SHA-256
📖 Explanation: SHA-256 is part of the SHA-2 family, which includes SHA-224, SHA-384, and SHA-512, offering stronger security than SHA-1.
82. Which hashing algorithm is used in Bitcoin’s Proof-of-Work mechanism?
A) SHA-1
B) SHA-256
C) MD5
D) HMAC
✅ Answer: B) SHA-256
📖 Explanation: Bitcoin’s Proof-of-Work (PoW) algorithm relies on SHA-256, ensuring security and immutability of blockchain transactions.
83. What does the term “one-way function” mean in hashing?
A) It only works with a single type of input
B) It cannot be reversed to retrieve the original input
C) It uses symmetric encryption
D) It requires a decryption key
✅ Answer: B) It cannot be reversed to retrieve the original input
📖 Explanation: Hash functions are one-way, meaning that given a hash, you cannot retrieve the original input.
84. What makes bcrypt more secure than traditional hashing algorithms for password storage?
A) It generates smaller hash values
B) It is optimized for speed
C) It includes a built-in salt and slows down brute-force attacks
D) It is based on SHA-256
✅ Answer: C) It includes a built-in salt and slows down brute-force attacks
📖 Explanation: Bcrypt is a slow hash function with a built-in salt, making brute-force attacks significantly harder.
85. What is the output size of SHA-384?
A) 256 bits
B) 384 bits
C) 512 bits
D) 160 bits
✅ Answer: B) 384 bits
📖 Explanation: SHA-384 produces a 384-bit hash output, making it more secure than SHA-256 while having a lower computational cost than SHA-512.
86. Which of the following algorithms is designed for secure file integrity verification?
A) SHA-256
B) AES-256
C) RSA-2048
D) ECC
✅ Answer: A) SHA-256
📖 Explanation: SHA-256 is widely used in file integrity checks to detect tampering and corruption.
87. Which attack is commonly used to exploit weaknesses in hash functions by finding two different inputs that result in the same hash?
A) Pre-image attack
B) Brute-force attack
C) Collision attack
D) Side-channel attack
✅ Answer: C) Collision attack
📖 Explanation: Collision attacks occur when two different inputs produce the same hash, which can break the security of the hash function.
88. Why is SHA-1 no longer considered secure for cryptographic use?
A) It generates very large hash values
B) It is too computationally expensive
C) It has known collision vulnerabilities
D) It cannot hash numeric data
✅ Answer: C) It has known collision vulnerabilities
📖 Explanation: SHA-1 is no longer secure because researchers have demonstrated collision attacks, making it unreliable for cryptographic security.
89. What is a Merkle tree used for in cryptographic applications?
A) Storing symmetric keys
B) Securing encrypted messages
C) Efficiently verifying large sets of hashed data
D) Generating random hash values
✅ Answer: C) Efficiently verifying large sets of hashed data
📖 Explanation: Merkle trees use hashes to efficiently verify the integrity of large datasets, such as in blockchain transactions.
90. What is the main advantage of SHA-3 over SHA-2?
A) It is faster on modern hardware
B) It is based on Keccak and offers better resistance to certain attacks
C) It generates shorter hash values
D) It is a symmetric encryption method
✅ Answer: B) It is based on Keccak and offers better resistance to certain attacks
📖 Explanation: SHA-3 uses the Keccak sponge construction, providing better security in some cryptographic applications.
91. Which of the following is NOT a recommended practice for securing hashed passwords?
A) Using a slow hash function
B) Adding a salt before hashing
C) Using a fixed, shared salt for all passwords
D) Implementing key stretching
✅ Answer: C) Using a fixed, shared salt for all passwords
📖 Explanation: Using a unique salt per password improves security, while a fixed salt makes passwords vulnerable to precomputed attacks.
92. What is the difference between a cryptographic hash function and a checksum?
A) Checksums are used only for passwords
B) Cryptographic hash functions are stronger and collision-resistant
C) Cryptographic hash functions are always faster
D) Checksums require secret keys
✅ Answer: B) Cryptographic hash functions are stronger and collision-resistant
📖 Explanation: Cryptographic hash functions offer collision resistance, while checksums are simpler and not secure against tampering.
93. What type of hashing algorithm is SHA-256?
A) Symmetric
B) Asymmetric
C) One-way
D) Reversible
✅ Answer: C) One-way
📖 Explanation: SHA-256 is a one-way hash function, meaning it cannot be reversed to obtain the original input.
94. What is the primary security benefit of using HMAC?
A) It speeds up hash computation
B) It ensures message integrity and authenticity using a secret key
C) It allows reversible hashing
D) It prevents brute-force attacks
✅ Answer: B) It ensures message integrity and authenticity using a secret key
📖 Explanation: HMAC uses a secret key with hashing to provide both integrity and authentication.
95. Why is a longer hash output generally more secure?
A) It reduces hash computation time
B) It increases storage efficiency
C) It makes brute-force and collision attacks more difficult
D) It allows for hash reversal when needed
✅ Answer: C) It makes brute-force and collision attacks more difficult
📖 Explanation: A longer hash output increases security by making brute-force and collision attacks computationally infeasible.
96. Which hashing algorithm is best suited for digital signatures?
A) SHA-1
B) MD5
C) SHA-256
D) DES
✅ Answer: C) SHA-256
📖 Explanation: SHA-256 is widely used in digital signatures, ensuring message integrity and authentication.
97. What makes a cryptographic hash function ideal for blockchain security?
A) It allows quick hash reversal
B) It ensures data immutability and integrity
C) It generates large file sizes
D) It provides symmetric encryption
✅ Answer: B) It ensures data immutability and integrity
📖 Explanation: Cryptographic hash functions like SHA-256 provide integrity and immutability, key requirements for blockchain security.
98. Why is it important to use a slow hashing function for password storage?
A) To make brute-force attacks less effective
B) To increase server performance
C) To generate shorter hash values
D) To ensure easy password recovery
✅ Answer: A) To make brute-force attacks less effective
📖 Explanation: Slow hashing functions (e.g., bcrypt, Argon2) make brute-force attacks significantly harder by increasing computational cost.
99. Which of the following hashing algorithms provides variable-length output?
A) SHA-1
B) SHA-256
C) SHA-3
D) MD5
✅ Answer: C) SHA-3
📖 Explanation: SHA-3 supports variable-length output, unlike SHA-1, SHA-256, or MD5.
100. Which attack is most effective against unsalted hashes?
A) Birthday attack
B) Dictionary attack
C) Man-in-the-middle attack
D) SQL injection
✅ Answer: B) Dictionary attack
📖 Explanation: Dictionary attacks use precomputed password lists to break unsalted hashes quickly.
101. Which hashing algorithm is the successor of MD5 and was originally designed as an improvement?
A) SHA-1
B) SHA-2
C) Whirlpool
D) SHA-3
✅ Answer: A) SHA-1
📖 Explanation: SHA-1 was developed as an improvement over MD5, but it is now considered insecure due to collision vulnerabilities.
102. What is the primary reason for using a keyed-hash message authentication code (HMAC)?
A) To speed up the hashing process
B) To ensure message integrity and authentication
C) To generate shorter hash values
D) To allow hash decryption
✅ Answer: B) To ensure message integrity and authentication
📖 Explanation: HMAC uses a secret key with hashing to verify both the integrity and authenticity of a message.
103. Why is the SHA-2 family considered more secure than SHA-1?
A) SHA-2 has a smaller output size
B) SHA-2 is faster than SHA-1
C) SHA-2 has stronger collision resistance
D) SHA-2 is easier to reverse
✅ Answer: C) SHA-2 has stronger collision resistance
📖 Explanation: SHA-2 is more resistant to collisions than SHA-1, making it a safer option for cryptographic applications.
104. What is the key difference between Blake2 and SHA-256?
A) Blake2 is slower but more secure
B) Blake2 is designed to be faster than SHA-256 while maintaining similar security
C) SHA-256 supports variable-length output
D) Blake2 is a symmetric encryption algorithm
✅ Answer: B) Blake2 is designed to be faster than SHA-256 while maintaining similar security
📖 Explanation: Blake2 is optimized for speed and efficiency while maintaining cryptographic security comparable to SHA-2.
105. Which of the following best describes a “birthday attack”?
A) An attack exploiting the probability of hash collisions
B) A brute-force attack on password hashes
C) A phishing attack targeting cryptographic keys
D) An attack that modifies the hash function itself
✅ Answer: A) An attack exploiting the probability of hash collisions
📖 Explanation: Birthday attacks exploit the mathematical probability that two inputs will generate the same hash due to the birthday paradox.
106. What is the purpose of using a “work factor” in hashing?
A) To improve hash reversibility
B) To slow down brute-force attacks by increasing computation time
C) To reduce memory usage in hashing
D) To allow easier computation of hash values
✅ Answer: B) To slow down brute-force attacks by increasing computation time
📖 Explanation: A work factor increases the number of iterations in hashing, making brute-force attacks less practical.
107. What is the primary reason MD5 is still used despite being insecure?
A) It is faster and widely supported for non-cryptographic use
B) It is the most secure hash function available
C) It is resistant to quantum computing attacks
D) It is used for encryption
✅ Answer: A) It is faster and widely supported for non-cryptographic use
📖 Explanation: MD5 is still used for file integrity checks and non-security purposes because of its speed and wide adoption.
108. Which cryptographic property ensures that finding two different inputs producing the same hash is computationally infeasible?
A) Pre-image resistance
B) Second pre-image resistance
C) Collision resistance
D) Determinism
✅ Answer: C) Collision resistance
📖 Explanation: Collision resistance ensures that two different inputs do not generate the same hash, making it a crucial property for secure hashing.
109. Why is SHA-3 fundamentally different from SHA-2?
A) SHA-3 is based on the Keccak sponge construction instead of Merkle-Damgård
B) SHA-3 is a symmetric encryption algorithm
C) SHA-3 produces smaller hash values
D) SHA-3 is only used for passwords
✅ Answer: A) SHA-3 is based on the Keccak sponge construction instead of Merkle-Damgård
📖 Explanation: SHA-3 uses a completely different cryptographic structure (Keccak sponge), providing improved security against certain attacks.
110. What type of attack does key stretching in password hashing help mitigate?
A) SQL injection
B) Brute-force attacks
C) Man-in-the-middle attacks
D) Side-channel attacks
✅ Answer: B) Brute-force attacks
📖 Explanation: Key stretching increases the computational time required to verify passwords, making brute-force attacks less effective.
111. Which hashing algorithm is considered the most suitable for modern password hashing?
A) SHA-1
B) PBKDF2
C) Argon2
D) MD5
✅ Answer: C) Argon2
📖 Explanation: Argon2 is specifically designed for secure password hashing, offering strong resistance to brute-force attacks.
112. Which of the following best describes a second pre-image attack?
A) Finding an input that produces a specific hash
B) Finding two different inputs that generate the same hash
C) Reversing a hash back to its original input
D) Altering the hash algorithm to break security
✅ Answer: A) Finding an input that produces a specific hash
📖 Explanation: Second pre-image resistance ensures that attackers cannot find another input that produces the same hash as a given input.
113. What makes HMAC different from a standard hash function?
A) It is a reversible hash
B) It uses a secret key for authentication
C) It generates shorter hash values
D) It is designed only for file integrity checks
✅ Answer: B) It uses a secret key for authentication
📖 Explanation: HMAC adds a secret key to the hashing process, ensuring both message integrity and authentication.
114. Which attack method is prevented by using a salt in password hashing?
A) Dictionary attack
B) Buffer overflow attack
C) Man-in-the-middle attack
D) SQL injection
✅ Answer: A) Dictionary attack
📖 Explanation: Salting makes precomputed dictionary attacks ineffective because each hash becomes unique.
115. Which cryptographic hash function is most resistant to side-channel attacks?
A) SHA-1
B) SHA-256
C) SHA-3
D) MD5
✅ Answer: C) SHA-3
📖 Explanation: SHA-3’s Keccak structure offers improved resistance to side-channel attacks compared to SHA-1 and SHA-2.
116. What is the main purpose of using a cryptographic hash in a blockchain?
A) To encrypt transaction data
B) To secure communications between nodes
C) To ensure data integrity and prevent tampering
D) To allow reversible encoding of blockchain transactions
✅ Answer: C) To ensure data integrity and prevent tampering
📖 Explanation: Hashes in a blockchain ensure that data has not been altered, maintaining immutability and security.
117. Which of the following makes a password hash function secure?
A) It should be as fast as possible
B) It should use a salt and key stretching
C) It should be easily reversible
D) It should generate a hash of fixed size
✅ Answer: B) It should use a salt and key stretching
📖 Explanation: Salting and key stretching make password hashes resistant to brute-force and dictionary attacks.
118. Which hashing algorithm is commonly used for digitally signing software packages?
A) MD5
B) SHA-256
C) Blowfish
D) AES
✅ Answer: B) SHA-256
📖 Explanation: SHA-256 is widely used for digital signatures in software verification, ensuring authenticity.
119. Why should password hashing functions be intentionally slow?
A) To reduce CPU usage
B) To make brute-force attacks impractical
C) To shorten the hash output
D) To make password recovery easier
✅ Answer: B) To make brute-force attacks impractical
📖 Explanation: Slower hash functions (e.g., Argon2, bcrypt) increase computation time, making brute-force attacks infeasible.
120. What is a major advantage of using Blake2 over SHA-256?
A) Faster computation while maintaining security
B) Ability to generate reversible hashes
C) Generates shorter hash values
D) Requires less entropy
✅ Answer: A) Faster computation while maintaining security
📖 Explanation: Blake2 provides similar security to SHA-256 but is optimized for speed, making it preferable in performance-critical applications.
121. What is the main reason that cryptographic hash functions are used in digital forensics?
A) To encrypt data for secure transmission
B) To verify the integrity of digital evidence
C) To store user passwords securely
D) To reduce the size of large files
✅ Answer: B) To verify the integrity of digital evidence
📖 Explanation: Hash functions help verify that digital evidence has not been altered, ensuring its authenticity in forensic investigations.
122. What property of a hash function ensures that finding the original input from its hash is computationally infeasible?
A) Avalanche effect
B) Pre-image resistance
C) Key stretching
D) Hash truncation
✅ Answer: B) Pre-image resistance
📖 Explanation: Pre-image resistance ensures that attackers cannot determine the original input from its hash, making brute-force attacks ineffective.
123. Which hashing algorithm was designed specifically to be fast while maintaining cryptographic security?
A) SHA-256
B) Argon2
C) Blake2
D) MD5
✅ Answer: C) Blake2
📖 Explanation: Blake2 is optimized for speed while maintaining security, making it suitable for general hashing applications.
124. What happens if even a single bit of input is changed in a cryptographic hash function?
A) The hash output remains mostly unchanged
B) The hash output changes significantly due to the avalanche effect
C) The hash function regenerates the same hash
D) The hash function crashes
✅ Answer: B) The hash output changes significantly due to the avalanche effect
📖 Explanation: The avalanche effect ensures that a small change in input leads to a drastically different hash output, enhancing security.
125. Which attack exploits weaknesses in hashing functions by modifying the hash without altering the original input?
A) Pre-image attack
B) Collision attack
C) Length extension attack
D) Side-channel attack
✅ Answer: C) Length extension attack
📖 Explanation: A length extension attack exploits the Merkle-Damgård construction, allowing attackers to append data to a hash without knowing the original input.
126. What is the purpose of increasing the number of iterations in a password hashing function like PBKDF2?
A) To speed up hash computations
B) To increase resistance to brute-force attacks
C) To make the hash reversible
D) To generate shorter hash values
✅ Answer: B) To increase resistance to brute-force attacks
📖 Explanation: Increasing iterations slows down hash computation, making brute-force attacks more computationally expensive.
127. Which of the following is NOT a recommended hashing algorithm for password storage?
A) bcrypt
B) SHA-256
C) Argon2
D) PBKDF2
✅ Answer: B) SHA-256
📖 Explanation: While SHA-256 is secure, it lacks built-in salting and key stretching, making it less ideal for password storage compared to bcrypt, Argon2, or PBKDF2.
128. What is the primary function of a cryptographic hash in Public Key Infrastructure (PKI)?
A) Encrypting private keys
B) Ensuring data integrity in digital signatures
C) Storing passwords securely
D) Generating symmetric encryption keys
✅ Answer: B) Ensuring data integrity in digital signatures
📖 Explanation: Cryptographic hash functions ensure message integrity in digital signatures, verifying that the message was not altered.
129. Why are hash functions used in blockchain technology?
A) To encrypt transactions
B) To verify data integrity and create immutable records
C) To generate random numbers for mining rewards
D) To reduce transaction fees
✅ Answer: B) To verify data integrity and create immutable records
📖 Explanation: Blockchain uses hash functions to secure transactions, ensure immutability, and verify data integrity.
130. Why is SHA-3 considered more resistant to length extension attacks than SHA-2?
A) SHA-3 supports asymmetric encryption
B) SHA-3 uses the Keccak sponge construction instead of Merkle-Damgård
C) SHA-3 is based on MD5 principles
D) SHA-3 allows reversible hashing
✅ Answer: B) SHA-3 uses the Keccak sponge construction instead of Merkle-Damgård
📖 Explanation: SHA-3’s Keccak sponge construction prevents length extension attacks, unlike SHA-2’s Merkle-Damgård structure.
131. Which hashing function was designed as an alternative to SHA-2 with improved security?
A) SHA-1
B) MD6
C) SHA-3
D) Whirlpool
✅ Answer: C) SHA-3
📖 Explanation: SHA-3 was developed to complement SHA-2, providing an alternative cryptographic approach with enhanced security.
132. What is the key advantage of using SHA-512 over SHA-256?
A) SHA-512 provides a larger hash output, making brute-force attacks harder
B) SHA-512 is faster than SHA-256
C) SHA-512 is less secure than SHA-256
D) SHA-512 uses smaller hash values
✅ Answer: A) SHA-512 provides a larger hash output, making brute-force attacks harder
📖 Explanation: SHA-512’s larger hash size (512-bit vs. 256-bit) provides stronger resistance to brute-force attacks.
133. Which hashing algorithm is best suited for digital timestamping and integrity verification?
A) SHA-256
B) bcrypt
C) AES-256
D) RSA
✅ Answer: A) SHA-256
📖 Explanation: SHA-256 is widely used for timestamping, file integrity verification, and ensuring authenticity in digital transactions.
134. What is a primary weakness of a fast hash function when used for password storage?
A) It produces too large hash values
B) It allows brute-force attacks to be executed faster
C) It cannot hash numeric data
D) It is not deterministic
✅ Answer: B) It allows brute-force attacks to be executed faster
📖 Explanation: Fast hash functions make brute-force attacks easier, which is why slow, memory-hard functions like Argon2 are recommended for passwords.
135. What is the purpose of using multiple rounds of hashing in password storage?
A) To speed up the authentication process
B) To increase brute-force resistance
C) To allow hash decryption when needed
D) To generate shorter hashes
✅ Answer: B) To increase brute-force resistance
📖 Explanation: Multiple hashing rounds (e.g., in PBKDF2, bcrypt, and Argon2) slow down brute-force attacks, making password cracking harder.
136. What is the primary reason why HMAC is secure against length extension attacks?
A) It encrypts the hash output
B) It uses a secret key along with the hash function
C) It generates variable-length outputs
D) It allows hash reversal
✅ Answer: B) It uses a secret key along with the hash function
📖 Explanation: HMAC prevents length extension attacks by including a secret key in the hashing process, ensuring data integrity.
137. Which hashing algorithm is best suited for integrity checks on firmware updates?
A) SHA-256
B) MD5
C) RC4
D) DES
✅ Answer: A) SHA-256
📖 Explanation: SHA-256 is widely used in verifying firmware updates to ensure that the updates have not been tampered with.
138. What is the role of salting in password hashing?
A) To increase hash computation speed
B) To make hash values smaller
C) To prevent precomputed attacks like rainbow tables
D) To allow hash reversal
✅ Answer: C) To prevent precomputed attacks like rainbow tables
📖 Explanation: Salting ensures that even identical passwords produce unique hashes, making rainbow table attacks ineffective.
139. Which hash function is used in the TLS (Transport Layer Security) protocol?
A) SHA-1
B) SHA-256
C) MD5
D) RC4
✅ Answer: B) SHA-256
📖 Explanation: SHA-256 is commonly used in TLS for secure web communications and authentication.
140. Which cryptographic attack attempts to find two different inputs that produce the same hash output?
A) Dictionary attack
B) Collision attack
C) Side-channel attack
D) Pre-image attack
✅ Answer: B) Collision attack
📖 Explanation: Collision attacks break the uniqueness property of hash functions, making them a significant security threat.
141. What is the primary advantage of using a cryptographic hash function over a checksum for data integrity?
A) Hash functions are faster
B) Hash functions provide stronger collision resistance
C) Checksums are more secure
D) Hash functions produce smaller outputs
✅ Answer: B) Hash functions provide stronger collision resistance
📖 Explanation: Cryptographic hash functions are designed to be collision-resistant and tamper-proof, whereas checksums (e.g., CRC32) are weaker and primarily detect accidental changes.
142. Which cryptographic property ensures that even the smallest change in input drastically alters the hash output?
A) Collision resistance
B) Pre-image resistance
C) Avalanche effect
D) Key stretching
✅ Answer: C) Avalanche effect
📖 Explanation: The avalanche effect ensures that even a minor modification in input leads to a significant change in hash output, enhancing security.
143. Why is MD5 unsuitable for secure password storage?
A) It is too slow for modern systems
B) It is vulnerable to hash collisions and fast brute-force attacks
C) It generates excessively large hash values
D) It uses too much memory
✅ Answer: B) It is vulnerable to hash collisions and fast brute-force attacks
📖 Explanation: MD5 is considered insecure due to its collision vulnerabilities and fast computation, making brute-force and rainbow table attacks effective.
144. What is a common use case for hashing in digital signatures?
A) Encrypting the original message
B) Ensuring data integrity and non-repudiation
C) Compressing large data sets
D) Generating public-private key pairs
✅ Answer: B) Ensuring data integrity and non-repudiation
📖 Explanation: Hashing in digital signatures ensures data integrity, preventing any unauthorized modifications while also providing non-repudiation.
145. Which attack attempts to find a second input that produces the same hash as a given input?
A) Collision attack
B) Pre-image attack
C) Second pre-image attack
D) Length extension attack
✅ Answer: C) Second pre-image attack
📖 Explanation: A second pre-image attack tries to find a new input that hashes to the same value as an existing input, compromising security.
146. What is the primary reason SHA-1 was deprecated?
A) It produces short hash values
B) It is computationally slow
C) It is vulnerable to collision attacks
D) It is not deterministic
✅ Answer: C) It is vulnerable to collision attacks
📖 Explanation: SHA-1 is no longer secure because researchers have found practical collision attacks, making it unsuitable for cryptographic security.
147. Which cryptographic hash function is used in the Bitcoin blockchain for proof-of-work?
A) MD5
B) SHA-1
C) SHA-256
D) Blake2
✅ Answer: C) SHA-256
📖 Explanation: Bitcoin uses SHA-256 for proof-of-work mining, ensuring security and immutability of transactions.
148. What makes SHA-3 different from SHA-2 in terms of security?
A) SHA-3 is faster than SHA-2
B) SHA-3 is based on the Keccak sponge construction, making it resistant to length extension attacks
C) SHA-3 produces shorter hash values
D) SHA-3 requires less memory
✅ Answer: B) SHA-3 is based on the Keccak sponge construction, making it resistant to length extension attacks
📖 Explanation: SHA-3’s Keccak sponge function enhances security by eliminating vulnerabilities present in Merkle-Damgård constructions (used in SHA-2).
149. What is the purpose of salting in password hashing?
A) To reduce the length of the hash
B) To make brute-force attacks faster
C) To make each hash unique, even if the same password is used by multiple users
D) To encrypt the hash
✅ Answer: C) To make each hash unique, even if the same password is used by multiple users
📖 Explanation: Salting prevents rainbow table attacks by ensuring that even identical passwords result in unique hash values.
150. Which hashing algorithm is recommended for securely storing passwords?
A) MD5
B) SHA-1
C) Argon2
D) SHA-256
✅ Answer: C) Argon2
📖 Explanation: Argon2 is a memory-hard function specifically designed for secure password hashing, making brute-force attacks more difficult.
151. Which of the following hashing algorithms allows variable-length output?
A) SHA-256
B) SHA-3
C) MD5
D) SHA-1
✅ Answer: B) SHA-3
📖 Explanation: SHA-3 supports variable-length output, unlike traditional fixed-length hash functions like SHA-1, SHA-2, and MD5.
152. Why is HMAC considered more secure than a regular hash function?
A) It is computationally faster
B) It uses a secret key to prevent tampering
C) It generates smaller hashes
D) It is reversible
✅ Answer: B) It uses a secret key to prevent tampering
📖 Explanation: HMAC enhances security by combining hashing with a secret key, preventing unauthorized modifications.
153. What is the output size of SHA-512?
A) 128 bits
B) 256 bits
C) 384 bits
D) 512 bits
✅ Answer: D) 512 bits
📖 Explanation: SHA-512 produces a 512-bit hash, making it more resistant to brute-force attacks.
154. What is the biggest advantage of using Blake2 over SHA-256?
A) It is faster while maintaining similar security
B) It produces shorter hash values
C) It uses less computational power
D) It generates variable-length outputs
✅ Answer: A) It is faster while maintaining similar security
📖 Explanation: Blake2 provides similar cryptographic security as SHA-256 but is optimized for faster performance.
155. What is the primary function of hashing in digital certificates?
A) To store private keys securely
B) To generate public keys
C) To verify integrity and authenticity of the certificate
D) To encrypt the certificate
✅ Answer: C) To verify integrity and authenticity of the certificate
📖 Explanation: Hashes in digital certificates ensure that the certificate has not been tampered with, preserving integrity.
156. Which attack relies on precomputed hash values to break password hashes quickly?
A) Brute-force attack
B) Dictionary attack
C) Rainbow table attack
D) Collision attack
✅ Answer: C) Rainbow table attack
📖 Explanation: Rainbow table attacks use precomputed hashes to crack password hashes quickly.
157. Which property ensures that a cryptographic hash function does not produce the same hash for different inputs?
A) Collision resistance
B) Reversibility
C) Key stretching
D) Hash chaining
✅ Answer: A) Collision resistance
📖 Explanation: Collision resistance prevents attackers from finding two different inputs that produce the same hash, ensuring uniqueness.
158. Why is bcrypt considered a strong password hashing function?
A) It allows for easy hash decryption
B) It generates smaller hash values
C) It uses salting and key stretching to slow down attacks
D) It is faster than MD5
✅ Answer: C) It uses salting and key stretching to slow down attacks
📖 Explanation: bcrypt includes built-in salting and key stretching, making brute-force attacks significantly harder.
159. Which cryptographic hashing algorithm is commonly used in digital forensic investigations?
A) MD5
B) SHA-1
C) SHA-256
D) RC4
✅ Answer: C) SHA-256
📖 Explanation: SHA-256 is widely used in digital forensics to verify the integrity of digital evidence.
160. What is a cryptographic hash function primarily used for in cybersecurity?
A) Encrypting files
B) Ensuring data integrity
C) Generating passwords
D) Secure key exchange
✅ Answer: B) Ensuring data integrity
📖 Explanation: Cryptographic hash functions ensure data integrity by verifying that information has not been modified.
161. What is the primary reason cryptographic hash functions are used in password authentication?
A) To encrypt passwords
B) To securely store and compare password hashes
C) To generate a symmetric key for encryption
D) To speed up authentication
✅ Answer: B) To securely store and compare password hashes
📖 Explanation: Passwords are hashed before storage, ensuring that even if a database is compromised, the original passwords remain protected.
162. Why is it important to use a salt with password hashes?
A) To decrease computational overhead
B) To prevent hash collisions
C) To ensure unique hash values even for identical passwords
D) To enable fast password recovery
✅ Answer: C) To ensure unique hash values even for identical passwords
📖 Explanation: Salts add randomness, preventing attackers from using precomputed hashes (rainbow tables) to crack passwords.
163. Which of the following hashing algorithms is NOT recommended for cryptographic security?
A) SHA-256
B) SHA-1
C) SHA-512
D) Argon2
✅ Answer: B) SHA-1
📖 Explanation: SHA-1 is deprecated due to collision vulnerabilities, making it insecure for modern cryptographic applications.
164. What is the difference between a hash function and encryption?
A) Hash functions can be reversed, while encryption cannot
B) Encryption requires a key, while a hash function does not
C) Hash functions increase data size, while encryption reduces it
D) Encryption is always faster than hashing
✅ Answer: B) Encryption requires a key, while a hash function does not
📖 Explanation: Encryption is reversible and requires a key, while hash functions are one-way and do not use keys.
165. What is a “pepper” in password hashing?
A) A secondary hash applied after salting
B) A random value stored separately from the hash to enhance security
C) A technique to shorten hash outputs
D) A method for hash decryption
✅ Answer: B) A random value stored separately from the hash to enhance security
📖 Explanation: A pepper is a secret value added before hashing, stored separately to enhance password security.
166. Which cryptographic hash function uses the Keccak sponge construction?
A) SHA-256
B) SHA-3
C) MD5
D) Whirlpool
✅ Answer: B) SHA-3
📖 Explanation: SHA-3 is based on the Keccak sponge construction, making it different from SHA-2, which uses the Merkle-Damgård structure.
167. Why is bcrypt preferred over SHA-256 for password hashing?
A) Bcrypt is faster than SHA-256
B) Bcrypt includes built-in salting and work factor adjustments
C) Bcrypt generates shorter hashes
D) Bcrypt does not require computational power
✅ Answer: B) Bcrypt includes built-in salting and work factor adjustments
📖 Explanation: Bcrypt is designed for password hashing with salting and key stretching, making brute-force attacks more difficult.
168. What is a major security risk of storing unsalted password hashes?
A) It increases computational complexity
B) It makes dictionary and rainbow table attacks easier
C) It requires more storage space
D) It allows easy password recovery
✅ Answer: B) It makes dictionary and rainbow table attacks easier
📖 Explanation: Without salting, identical passwords produce the same hash, making attacks using precomputed hash tables feasible.
169. Which of the following cryptographic attacks exploits a hash function’s structure to append data to a hash?
A) Collision attack
B) Pre-image attack
C) Length extension attack
D) Man-in-the-middle attack
✅ Answer: C) Length extension attack
📖 Explanation: Length extension attacks exploit hash functions using the Merkle-Damgård construction, allowing data to be appended without knowing the original input.
170. Which hashing algorithm is optimized for fast performance while maintaining security?
A) MD5
B) SHA-256
C) Blake2
D) AES
✅ Answer: C) Blake2
📖 Explanation: Blake2 is optimized for high-speed hashing, making it more efficient than SHA-256 while maintaining similar security.
171. What is the main reason why HMAC is used for message authentication?
A) It is a symmetric encryption algorithm
B) It provides both integrity and authentication using a secret key
C) It generates reversible hashes
D) It requires low computational resources
✅ Answer: B) It provides both integrity and authentication using a secret key
📖 Explanation: HMAC adds a secret key to hashing, ensuring both data integrity and authentication.
172. Why is Argon2 considered superior to bcrypt for password hashing?
A) Argon2 uses GPU-hard memory-intensive computations
B) Argon2 generates shorter hash values
C) Argon2 does not require salting
D) Argon2 is faster for password verification
✅ Answer: A) Argon2 uses GPU-hard memory-intensive computations
📖 Explanation: Argon2 is designed to resist GPU and ASIC brute-force attacks by making computations memory-hard.
173. Which of the following is a major weakness of SHA-1?
A) It produces hashes that are too long
B) It is vulnerable to collision attacks
C) It cannot hash binary data
D) It is not supported in modern browsers
✅ Answer: B) It is vulnerable to collision attacks
📖 Explanation: SHA-1 is deprecated because attackers have successfully demonstrated collision attacks.
174. Which hash function is commonly used in TLS and SSL certificates?
A) SHA-1
B) MD5
C) SHA-256
D) Blowfish
✅ Answer: C) SHA-256
📖 Explanation: SHA-256 is widely used in TLS and SSL certificates to ensure secure communication.
175. Which attack tries to find two different inputs that produce the same hash?
A) Pre-image attack
B) Collision attack
C) Dictionary attack
D) Brute-force attack
✅ Answer: B) Collision attack
📖 Explanation: Collision attacks attempt to find two distinct inputs that hash to the same value, breaking a hash function’s uniqueness property.
176. What makes SHA-512 more secure than SHA-256?
A) It requires less computational power
B) It generates a longer hash output, making brute-force attacks harder
C) It is faster for hashing passwords
D) It allows easier hash reversibility
✅ Answer: B) It generates a longer hash output, making brute-force attacks harder
📖 Explanation: SHA-512’s 512-bit hash length makes it more resistant to brute-force attacks than SHA-256.
177. What is the purpose of key stretching in password hashing?
A) To reduce hash computation time
B) To increase the complexity of brute-force attacks
C) To decrease memory usage
D) To make hash functions reversible
✅ Answer: B) To increase the complexity of brute-force attacks
📖 Explanation: Key stretching (e.g., in PBKDF2, bcrypt, Argon2) makes password hashing computationally expensive, deterring brute-force attacks.
178. Which hashing algorithm is used for verifying the integrity of large files?
A) SHA-256
B) MD5
C) RC4
D) DES
✅ Answer: A) SHA-256
📖 Explanation: SHA-256 is widely used for verifying file integrity, ensuring files have not been modified.
179. What is the key benefit of using HMAC over regular hashing?
A) HMAC uses symmetric encryption
B) HMAC provides both integrity and authentication using a secret key
C) HMAC produces smaller hash values
D) HMAC allows for hash reversibility
✅ Answer: B) HMAC provides both integrity and authentication using a secret key
📖 Explanation: HMAC strengthens data integrity verification by combining hashing with a secret key, preventing tampering.
180. Why is SHA-3 considered more resistant to quantum attacks than SHA-2?
A) It is a symmetric encryption algorithm
B) It has a different internal structure that offers better post-quantum security
C) It is faster than SHA-2
D) It generates smaller hash outputs
✅ Answer: B) It has a different internal structure that offers better post-quantum security
📖 Explanation: SHA-3’s Keccak sponge function provides stronger resistance to potential quantum computing threats.
181. What is the primary purpose of a cryptographic hash function in password storage?
A) To encrypt the password
B) To store the password in plaintext securely
C) To allow secure password verification without storing the actual password
D) To generate a decryption key for the password
✅ Answer: C) To allow secure password verification without storing the actual password
📖 Explanation: Cryptographic hash functions store passwords securely by converting them into irreversible hash values, preventing password leaks in case of a database breach.
182. What makes PBKDF2 more secure than SHA-256 for password hashing?
A) PBKDF2 is faster
B) PBKDF2 includes multiple iterations to slow down brute-force attacks
C) PBKDF2 produces smaller hash values
D) PBKDF2 does not require salting
✅ Answer: B) PBKDF2 includes multiple iterations to slow down brute-force attacks
📖 Explanation: PBKDF2 uses key stretching, applying thousands of iterations, making brute-force attacks more difficult.
183. What is the main disadvantage of using SHA-256 for password hashing?
A) It is too slow for password verification
B) It does not have built-in salting or key stretching
C) It generates variable-length hashes
D) It requires a symmetric key
✅ Answer: B) It does not have built-in salting or key stretching
📖 Explanation: SHA-256 is a general-purpose hash function and lacks key stretching or salting, making it unsuitable for secure password storage.
184. Which of the following best describes a brute-force attack against hashed passwords?
A) Trying all possible inputs until a match is found
B) Using a mathematical function to reverse the hash
C) Sending fake login requests repeatedly
D) Altering the hashing algorithm to break security
✅ Answer: A) Trying all possible inputs until a match is found
📖 Explanation: A brute-force attack systematically tries all possible password combinations to find a matching hash.
185. Which hashing algorithm is designed to be resistant to GPU-based brute-force attacks?
A) MD5
B) SHA-1
C) Argon2
D) SHA-512
✅ Answer: C) Argon2
📖 Explanation: Argon2 is a memory-hard function, meaning it uses high memory consumption, making it resistant to GPU and ASIC-based brute-force attacks.
186. What is the key difference between SHA-256 and SHA-3?
A) SHA-256 is faster than SHA-3
B) SHA-3 is based on the Keccak sponge construction
C) SHA-3 requires a symmetric key
D) SHA-256 allows for hash reversibility
✅ Answer: B) SHA-3 is based on the Keccak sponge construction
📖 Explanation: SHA-3 uses the Keccak sponge function, which differs from SHA-256’s Merkle-Damgård construction.
187. Why is it important for cryptographic hash functions to be deterministic?
A) To ensure the same input always produces the same hash
B) To allow easy decryption of the hash
C) To generate different hashes for the same input
D) To increase hashing speed
✅ Answer: A) To ensure the same input always produces the same hash
📖 Explanation: Deterministic behavior ensures that a given input always results in the same hash, which is essential for data integrity verification.
188. Which of the following is a major limitation of using MD5 for digital signatures?
A) It is too slow for modern applications
B) It is vulnerable to collision attacks
C) It generates too large hash outputs
D) It does not work on large files
✅ Answer: B) It is vulnerable to collision attacks
📖 Explanation: MD5 is no longer secure due to known collision vulnerabilities, making it unsuitable for cryptographic security applications.
189. What property ensures that an attacker cannot generate two different inputs that hash to the same value?
A) Avalanche effect
B) Pre-image resistance
C) Collision resistance
D) Key expansion
✅ Answer: C) Collision resistance
📖 Explanation: Collision resistance ensures that no two different inputs should generate the same hash output, making the hash function secure.
190. Which hashing algorithm is widely used for verifying file integrity?
A) AES-256
B) SHA-256
C) RSA
D) DES
✅ Answer: B) SHA-256
📖 Explanation: SHA-256 is commonly used for file integrity verification, ensuring that a file has not been altered.
191. Why is salting not required in HMAC-based authentication?
A) HMAC is already slow and resistant to brute-force attacks
B) HMAC uses a secret key, which prevents precomputed attacks
C) HMAC is only used for password hashing
D) HMAC generates reversible hashes
✅ Answer: B) HMAC uses a secret key, which prevents precomputed attacks
📖 Explanation: HMAC incorporates a secret key, eliminating the need for salting since precomputed attacks become ineffective.
192. What is the role of hashing in blockchain technology?
A) Encrypting transactions
B) Generating digital signatures
C) Securing transaction data and ensuring immutability
D) Storing large amounts of transaction data
✅ Answer: C) Securing transaction data and ensuring immutability
📖 Explanation: Hashes secure transactions in a blockchain, preventing unauthorized modifications and ensuring data immutability.
193. What is a hash digest?
A) A reversed hash function
B) A short description of a hash
C) The fixed-length output of a hash function
D) The secret key used in hash calculations
✅ Answer: C) The fixed-length output of a hash function
📖 Explanation: A hash digest is the output generated from hashing an input, usually fixed in length regardless of input size.
194. Why is SHA-3 considered more resistant to certain cryptographic attacks than SHA-2?
A) It is based on MD5 principles
B) It requires fewer computational resources
C) It is built on the Keccak sponge function
D) It generates shorter hash values
✅ Answer: C) It is built on the Keccak sponge function
📖 Explanation: SHA-3’s Keccak sponge construction offers enhanced resistance to length extension and side-channel attacks.
195. What is the main disadvantage of using a cryptographic hash function in digital signatures?
A) Hash functions require secret keys
B) Hash functions are slow for signing operations
C) If the hash function is broken, the digital signature becomes vulnerable
D) Hash functions cannot process large messages
✅ Answer: C) If the hash function is broken, the digital signature becomes vulnerable
📖 Explanation: Digital signatures rely on hash function security, meaning that if a hash function is compromised, the signature’s integrity is also at risk.
196. Why is HMAC commonly used in API authentication?
A) It speeds up authentication
B) It encrypts API requests
C) It provides integrity and authentication using a shared secret
D) It reduces API response time
✅ Answer: C) It provides integrity and authentication using a shared secret
📖 Explanation: HMAC is widely used in API security to ensure the integrity and authenticity of requests using a shared secret.
197. What type of attack exploits weaknesses in hash functions to forge digital signatures?
A) Man-in-the-middle attack
B) Length extension attack
C) Pre-image attack
D) Hash collision attack
✅ Answer: D) Hash collision attack
📖 Explanation: Hash collision attacks can allow attackers to create forged digital signatures, making the use of secure hash functions essential.
198. What is an ideal property of a secure hash function?
A) It should be reversible
B) It should produce a unique hash for each input
C) It should generate hash outputs of variable lengths
D) It should allow easy hash modification
✅ Answer: B) It should produce a unique hash for each input
📖 Explanation: A secure hash function should ensure that no two different inputs produce the same hash (collision resistance).
199. Why is SHA-256 widely used in digital forensics?
A) It speeds up forensic analysis
B) It helps verify the integrity of digital evidence
C) It encrypts forensic logs
D) It generates human-readable hashes
✅ Answer: B) It helps verify the integrity of digital evidence
📖 Explanation: SHA-256 is used in forensic investigations to verify that digital evidence remains unaltered.
200. Which hash function is recommended for secure password storage today?
A) MD5
B) SHA-1
C) Argon2
D) SHA-3
✅ Answer: C) Argon2
📖 Explanation: Argon2 is the most recommended hashing algorithm for password storage, offering high resistance to brute-force attacks.