Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: CryptographySwitch
All CISSP topics

3.0 Security Architecture and Engineering

Cryptography Practice Questions

Symmetric and asymmetric algorithms, hashing, digital signatures, PKI, key management, and cryptanalytic attacks.

One solved question, so you can see how these are marked

A security manager must protect a large database while keeping routine encryption and decryption efficient. Which approach is BEST for the data itself?

Use AES symmetric encryption with a securely managed key.

Symmetric encryption is efficient for bulk data, and AES is a suitable example when its keys are managed securely. RSA is generally used for small values or key establishment, a hash does not provide reversible confidentiality, and a signature provides integrity and authenticity rather than encryption.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 9 Cryptography questions in this set

Answers and explanations appear when you work through the set above.

  1. An application encrypts records with AES in ECB mode. Repeated fields produce repeated ciphertext blocks. What is the MOST important design concern?

    • ECB requires a public key instead of a shared key.
    • Identical ECB plaintext blocks produce identical ciphertext, revealing patterns.
    • ECB cannot encrypt data whose length is an exact multiple of the block size.
    • ECB automatically authenticates each record but cannot provide confidentiality.

  2. A company is selecting a cryptographic standard for a new service. Which statement BEST describes the relationship between key length and security?

    • A longer key always makes any algorithm secure regardless of its design.
    • The key length is irrelevant when the algorithm is publicly documented.
    • Select algorithm and key length together, considering implementation and effective key space.
    • A symmetric key and an asymmetric key of equal bit length provide the same security strength against cryptanalysis.

  3. A risk assessment finds that encryption keys are copied into administrator scripts and retained indefinitely. What should the manager do FIRST?

    • Increase the key length for every existing key.
    • Replace all symmetric encryption with hashing.
    • Publish encryption keys alongside certificates in the internal repository to simplify recovery.
    • Define a lifecycle for key generation, protection, rotation, recovery, and destruction.

  4. A service must detect whether a message was altered and confirm that it came from a party sharing a secret with the service. Which control is MOST appropriate?

    • HMAC with a shared secret.
    • A plain hash of the message published beside it.
    • Encryption with the recipient's public key only.
    • A certificate revocation list.

  5. A procurement system needs evidence that an approved supplier signed an order and that the order was not changed afterward. Which mechanism BEST meets this requirement?

    • A shared password stored with the order.
    • A supplier private-key signature verified with its trusted public key.
    • A checksum of the order contents, attached to the purchase record without a secret or signing key.
    • A symmetric ciphertext encrypted with the buyer's key.

  6. A company wants employees to receive certificates, while a separate team validates identities and approves certificate requests. Which PKI role should perform that validation?

    • The certificate repository, which only distributes certificates and status data.
    • The CRL issuer, which publishes revocation lists.
    • The registration authority, performing identity vetting for the CA.
    • The OCSP responder, which reports current certificate status.

  7. A verifier needs to determine whether a certificate was revoked without downloading a potentially large periodic list. Which service is the BEST fit?

    • A key escrow service that stores recovery keys.
    • A certificate repository that stores the CA certificate only.
    • A hashing service that calculates a new certificate fingerprint.
    • An OCSP responder returning status for a certificate.

  8. An organization must preserve access to encrypted legal records if an employee holding a key leaves. Which control BEST balances recovery and separation of duties?

    • Authorized, documented key escrow under dual control.
    • Give every system administrator a copy of each private key.
    • Store the keys in the same database as the encrypted records.
    • Disable key rotation so the original key remains available forever.

  9. An attacker compares power consumption and response timing while a device performs private key operations. Which risk and mitigation should the manager prioritize?

    • A birthday attack, mitigated by increasing certificate validity periods.
    • A known plaintext attack, mitigated by publishing more sample plaintext.
    • A side-channel attack, reduced by constant-time code and leakage control.
    • A downgrade attack, mitigated by enabling older protocol versions.