- A company implements data masking for its test and development environments. The primary purpose of data masking is to:
Answer: Replace sensitive production data values with realistic but fictitious values so developers can work with functional data without exposing real sensitive information.
Data masking substitutes real sensitive data (SSNs, credit card numbers, names) with realistic but fake values, allowing development and testing to use realistic data structures without exposing actual sensitive information. Answer C is correct. Data masking is not encryption (A). It enables developer access with safe data (B). It is not a backup mechanism (D).
- A company's cloud storage provider offers 'client-side encryption.' What does this mean for data security?
Answer: The customer encrypts data before uploading it to the cloud, holding the encryption keys so the provider cannot access the plaintext data.
Client-side encryption means the customer encrypts data locally before uploading, retaining sole control of encryption keys so the cloud provider stores only ciphertext and cannot access the actual data. Answer C is correct. Provider-managed encryption (A) gives the provider key access. Transmission-only encryption (B) leaves stored data unprotected. Shared key management (D) is a different model.
- An organization's policy requires 'encryption at rest' for all databases containing personally identifiable information (PII). Which of the following best describes 'encryption at rest'?
Answer: Encrypting data stored on disk so it is unreadable without the decryption key, even if the physical media is accessed.
Encryption at rest protects data stored on physical or virtual storage media - databases, files, disks - ensuring it cannot be read without the decryption key, even if the media is accessed directly. Answer D is correct. Data in transit encryption (A) is separate. In-memory encryption (B) is a different concept. Backup tape encryption (C) is a subset but not the complete definition.
- A company discovers that an employee has been emailing customer financial data to a personal email account. Which of the following data protection controls would have been most effective at preventing this?
Answer: A data loss prevention (DLP) policy that blocks or quarantines outbound emails containing sensitive financial data patterns.
DLP policies can inspect outbound email content for sensitive data patterns and block or alert on transmissions of customer financial data. Answer A is correct. Full-disk encryption (B) protects stored data but not emails sent from the device. MFA (C) prevents unauthorized login but not insider data exfiltration by authorized users. Backups (D) provide recovery, not prevention.
- An organization implements a hardware security module (HSM) for cryptographic operations. The primary purpose of an HSM is to:
Answer: Securely generate, store, and manage cryptographic keys in tamper-resistant hardware, preventing key exposure even to administrators.
An HSM is a dedicated hardware device that performs cryptographic operations and stores keys in a tamper-resistant environment, ensuring keys are never exposed in plaintext outside the HSM. Answer D is correct. Network traffic encryption (A), database backup (B), and access monitoring (C) are not HSM functions.
- A legacy app needs reversible encrypted SSNs to stay 9 digits. Best choice?
Answer: Format-preserving encryption
Format-preserving encryption is the best fit: it encrypts a 9-digit SSN directly into another 9-digit value that can be decrypted with the key, so you keep both reversibility and the fixed format. Vault-based tokenization is the tempting wrong choice because it also preserves 9-digit values and is reversible, but it isn't encryption: it swaps the SSN for a surrogate token stored in a vault, so it doesn't meet the encrypted-SSN requirement.
- A company implements full-disk encryption on all employee laptops. This control primarily protects against which threat?
Answer: Unauthorized access to data if the laptop is lost or stolen.
Full-disk encryption protects data stored on the device from being read if the laptop is physically lost or stolen, since the data is unreadable without the encryption key. Answer C is correct. Full-disk encryption does not prevent malware (A), remote access attacks (B), or data interception in transit (D).
- Which property does ECDHE preserve after a server key compromise?
Answer: Past session confidentiality
ECDHE uses ephemeral key pairs, so each session's shared secret is discarded after the handshake. If the server's long-term key is later compromised, an attacker cannot recover old session keys, so past session confidentiality remains intact. The tempting error is future session integrity: a compromised server key does allow impersonation going forward, but forward secrecy is about protecting sessions that already happened.
- A Certificate Authority (CA) in a PKI system is responsible for:
Answer: Issuing, validating, and revoking digital certificates that bind public keys to verified identities.
A CA is the trusted third party that issues digital certificates after verifying the identity of the applicant, and maintains certificate revocation lists (CRLs) for compromised or expired certificates. Answer D is correct. CAs do not generate symmetric keys (A), store private keys (B), or monitor network traffic (C).
- In asymmetric encryption, which key is used to encrypt data that only the intended recipient should be able to read?
Answer: The recipient's public key.
To send a confidential message, the sender encrypts it with the recipient's public key. Only the recipient, who holds the corresponding private key, can decrypt it. Answer B is correct. Encrypting with the private key (A, C) produces a digital signature (authentication), not confidentiality. Session keys (D) describe hybrid encryption, not pure asymmetric encryption.
- A DB column using AES-GCM with a random nonce cannot support equality lookups because:
Answer: Ciphertext is probabilistic
Because AES-GCM with a random nonce produces a different ciphertext for the same plaintext each time, equality lookups fail: identical values no longer match byte-for-byte. A tempting wrong answer is that GCM lacks authentication, but GCM is an authenticated encryption mode. The nonce's purpose is uniqueness, not enabling equality comparisons.
- Which of the following correctly describes a 'man-in-the-middle' attack and the encryption control that most directly prevents it?
Answer: An attacker intercepts communications between two parties; digital certificates and TLS mutual authentication prevent this by verifying the identity of communicating parties.
A MITM attack intercepts communications between parties. TLS with digital certificates prevents MITM by enabling each party to verify the other's identity, preventing an attacker from impersonating a legitimate endpoint. Answer A is correct. Malware (B) is an endpoint threat. Brute-force key guessing (C) is a separate attack. Key theft and revocation (D) are different scenarios.
- Which of the following statements about asymmetric encryption is correct?
Answer: Asymmetric encryption uses a mathematically related key pair; data encrypted with one key can only be decrypted with the other key in the pair.
Asymmetric encryption uses a key pair - public and private - where data encrypted with the public key can only be decrypted with the private key and vice versa. Answer B is correct. Asymmetric uses different keys, not the same key (A). It is significantly slower than symmetric (C). Key management is essential for asymmetric systems (D).
- Data loss prevention (DLP) tools are primarily designed to:
Answer: Monitor, detect, and prevent the unauthorized transmission or exfiltration of sensitive data outside the organization.
DLP solutions inspect data in motion (email, web), at rest (stored files), and in use (clipboard, USB) to identify and block unauthorized transmission of sensitive data such as PII, financial data, or intellectual property. Answer A is correct. Encryption (B), authentication (C), and data recovery (D) are separate controls.
- A digital signature is created by:
Answer: Hashing the message and encrypting the hash with the sender's private key.
A digital signature is created by hashing the message content and encrypting the hash with the sender's private key. Recipients verify the signature by decrypting with the sender's public key and comparing the hash. Answer D is correct. Encrypting with the recipient's public key (A, B) provides confidentiality, not authentication. Symmetric keys (C) do not provide non-repudiation.
- Which of the following hashing algorithms is considered cryptographically broken and should not be used for security-sensitive applications?
Answer: MD5
MD5 has well-known collision vulnerabilities - it is computationally feasible to produce two different inputs with the same MD5 hash - making it cryptographically broken for security applications. Answer C is correct. SHA-256 (A), SHA-3 (B), and BLAKE2 (D) are current, secure hashing algorithms.
- Which of the following best describes symmetric encryption?
Answer: A method that uses the same secret key for both encryption and decryption.
Symmetric encryption uses a single shared key for both encryption and decryption. It is fast but requires secure key exchange between parties. Answer D is correct. Answer A describes asymmetric encryption. Answer B describes hashing. Answer C also describes asymmetric encryption (public/private key pair).
- Tokenization as a data protection technique differs from encryption in that:
Answer: Tokenization replaces sensitive data with a non-sensitive placeholder (token) with no mathematical relationship to the original data, requiring a secure token vault to retrieve the original.
Tokenization substitutes a sensitive value with a random token stored in a separate secure vault; unlike encryption, there is no algorithm to reverse a token without accessing the vault. Answer B is correct. Tokenization is not mathematically stronger or weaker than encryption (A). It requires vault access to reverse (C). It applies to various data types (D).
- An organization stores employee passwords as salted hashes rather than in plaintext. The primary purpose of 'salting' is to:
Answer: Prevent attackers from using precomputed hash tables (rainbow tables) to crack passwords by adding a unique random value to each password before hashing.
A salt is a unique random value added to each password before hashing, making identical passwords produce different hashes and rendering precomputed rainbow table attacks ineffective. Answer D is correct. Salting does not affect password length for users (A), involve symmetric encryption (B), or enable password recovery (C).
- To trust a sender's digitally signed hash, what must you validate first?
Answer: Sender's certificate chain
To trust a digitally signed hash, you need the sender's public key and proof that it really belongs to that sender. That proof comes from validating the sender's certificate chain up to a trusted root. The tempting wrong answer is that the hash algorithm must be strong, but even a strong hash is useless if you cannot trust the signer's identity and public key.
