Question-58: There are now applications that may change identities and mobile phone numbers that are widely available on the internet. A single download is all that is required for fraudsters to send text messages from whatever number they want, using the names of well-known corporations or even institutions. Some companies even provide spoofing internet services, which is getting dangerously close to being against the law. You are building a mobile conversation application. You want to make sure that users are unable to forge chat messages by making it seem as if a message was delivered by a certain person. What action should you take?
A. On the client side, append the identify of the user who sent the message, as well as the user who will receive it.
B. Encrypt the message using a block-based encryption method and a shared key on the client side.
C. Encrypt the message on the client side by utilising public key infrastructure (PKI) and the private key of the person who initiated the communication.
D. To allow SSL communication between the client application and the server, make use of a certificate authority that you can put your faith in.
Correct Answer
Get All 340 Questions and Answer for Google Professional Cloud Architect
: 3 Explanation: Option-4 works if SSL client authentication is enabled. Option-3 works as well if the client encrypts messages with a private key and server decrypts with a public key. I prefer C. Encrypting each block and tagging each message at the client side is an overhead on the application. Best method which has been adopted since years is contacting SSL providers and using public certificates to encrypt the traffic between client and server. SSL doesn't use the server's public key to encrypt data. This is definitely wrong. Please read SSL specs. SSL uses a separate session key for message encryption. This session key is temporary and will be rotated for every single session. PKI uses X.509 certificates and Public Keys, where the key is used for end-to-end encrypted communication, so that both parties can trust each other and test their authenticity. PKI is mostly used in TLS/SSL to secure connections between the user and the server, while the user tests the server’s authenticity to make sure it’s not spoofed. SSL connection using Certificates provides a secure communication channel between the client and server, thereby preventing anyone from tampering with the data being exchanged. D is the correct answer.