CPA Isc Quiz: Assess Encryption And Data Protection Methods

What this quiz covers

This quiz focuses on Assess Encryption And Data Protection Methods, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. Protecting data stored on the company's database servers from unauthorized access.
2. Protecting data in transit from interception and tampering by encrypting communications between the client and server. (correct answer)
3. Preventing unauthorized users from logging into the web application.
4. Ensuring that the web application code is free from vulnerabilities.

Explanation: TLS encrypts data as it travels across the network, protecting it from interception (eavesdropping) and modification (man-in-the-middle attacks) during transmission. Answer B is correct. TLS does not protect stored data (A), manage authentication (C), or secure application code (D).

Question 2

1. Encryption is faster than hashing and is therefore preferred for all data protection use cases.
2. Hashing uses a key while encryption does not.
3. Encryption is reversible with the appropriate key; hashing is a one-way function that cannot be reversed. (correct answer)
4. Hashing protects data in transit while encryption protects data at rest.

Explanation: Encryption transforms data in a reversible way using a key; decryption recovers the original. Hashing produces a fixed-length digest that cannot be reversed to recover the original data. Answer C is correct. Speed comparison (A) is not the defining difference. Hashing typically does not use a secret key (B). Both can apply to data at rest or in transit (D).

Question 3

1. Malware installed on the laptop through phishing emails.
2. Unauthorized remote access to the laptop over the network.
3. Unauthorized access to data if the laptop is lost or stolen. (correct answer)
4. Interception of data transmitted from the laptop to the internet.

Explanation: Full-disk encryption protects data stored on the device from being read if the laptop is physically lost or stolen, since the data is unreadable without the encryption key. Answer C is correct. Full-disk encryption does not prevent malware (A), remote access attacks (B), or data interception in transit (D).

Question 4

1. The recipient's private key.
2. The recipient's public key. (correct answer)
3. The sender's private key.
4. A symmetric key generated for each session.

Explanation: To send a confidential message, the sender encrypts it with the recipient's public key. Only the recipient, who holds the corresponding private key, can decrypt it. Answer B is correct. Encrypting with the private key (A, C) produces a digital signature (authentication), not confidentiality. Session keys (D) describe hybrid encryption, not pure asymmetric encryption.

Question 5

1. Monitor, detect, and prevent the unauthorized transmission or exfiltration of sensitive data outside the organization. (correct answer)
2. Encrypt all data stored on employee workstations and servers.
3. Authenticate users before they access sensitive data systems.
4. Recover deleted or corrupted data from damaged storage media.

Explanation: DLP solutions inspect data in motion (email, web), at rest (stored files), and in use (clipboard, USB) to identify and block unauthorized transmission of sensitive data such as PII, financial data, or intellectual property. Answer A is correct. Encryption (B), authentication (C), and data recovery (D) are separate controls.

Question 6

1. Storing encryption keys in the same location as the encrypted data to simplify recovery.
2. Storing encryption keys separately from the encrypted data and rotating keys on a defined schedule. (correct answer)
3. Using the same encryption key for all systems and data types to simplify management.
4. Sharing encryption keys with all employees who might need access to encrypted data.

Explanation: Key management best practice requires storing keys separately from encrypted data (compromising both together defeats encryption), rotating keys periodically to limit exposure, and controlling key access tightly. Answer B is correct. Storing keys with data (A) undermines encryption. Using one key everywhere (C) means a single compromise exposes all data. Broad key sharing (D) eliminates access control.

Question 7

1. Generating symmetric encryption keys for each secure communication session.
2. Storing encrypted copies of all private keys issued to users.
3. Monitoring network traffic for unauthorized use of digital certificates.
4. Issuing, validating, and revoking digital certificates that bind public keys to verified identities. (correct answer)

Explanation: A CA is the trusted third party that issues digital certificates after verifying the identity of the applicant, and maintains certificate revocation lists (CRLs) for compromised or expired certificates. Answer D is correct. CAs do not generate symmetric keys (A), store private keys (B), or monitor network traffic (C).

Question 8

1. Tokenization uses stronger mathematical algorithms than encryption.
2. Tokenization replaces sensitive data with a non-sensitive placeholder (token) with no mathematical relationship to the original data, requiring a secure token vault to retrieve the original. (correct answer)
3. Tokenization is reversible using publicly available tools without a key.
4. Tokenization can only be applied to numeric data fields such as credit card numbers.

Explanation: Tokenization substitutes a sensitive value with a random token stored in a separate secure vault; unlike encryption, there is no algorithm to reverse a token without accessing the vault. Answer B is correct. Tokenization is not mathematically stronger or weaker than encryption (A). It requires vault access to reverse (C). It applies to various data types (D).

Question 9

1. An attacker intercepts communications between two parties; digital certificates and TLS mutual authentication prevent this by verifying the identity of communicating parties. (correct answer)
2. An attacker installs malware on a target system; endpoint encryption prevents this by protecting stored data.
3. An attacker guesses encryption keys through brute force; longer key lengths prevent this by increasing computational complexity.
4. An attacker steals a private key; certificate revocation prevents this by invalidating the stolen key.

Explanation: A MITM attack intercepts communications between parties. TLS with digital certificates prevents MITM by enabling each party to verify the other's identity, preventing an attacker from impersonating a legitimate endpoint. Answer A is correct. Malware (B) is an endpoint threat. Brute-force key guessing (C) is a separate attack. Key theft and revocation (D) are different scenarios.

Question 10

1. Outdated algorithms require more processing power, slowing down systems.
2. Advances in computing power make weak algorithms vulnerable to brute-force or known attacks, potentially exposing encrypted data. (correct answer)
3. Outdated algorithms are not compatible with modern operating systems.
4. Regulatory agencies may assess fines for using non-standard encryption, regardless of actual security impact.

Explanation: Weak encryption algorithms (DES, RC4) have known vulnerabilities or insufficient key lengths that modern computing power can exploit, making the encrypted data recoverable by attackers. Answer B is correct. Performance (A) is a secondary concern. Compatibility (C) may be an issue but is not the primary risk. Regulatory fines (D) may result but are a consequence of the security risk, not the risk itself.

Question 11

1. Asymmetric encryption uses the same key for both encryption and decryption, making it more secure than symmetric encryption.
2. Asymmetric encryption uses a mathematically related key pair; data encrypted with one key can only be decrypted with the other key in the pair. (correct answer)
3. Asymmetric encryption is faster than symmetric encryption and is therefore preferred for encrypting large volumes of data.
4. Asymmetric encryption does not require key management since keys are generated on demand for each transaction.

Explanation: Asymmetric encryption uses a key pair - public and private - where data encrypted with the public key can only be decrypted with the private key and vice versa. Answer B is correct. Asymmetric uses different keys, not the same key (A). It is significantly slower than symmetric (C). Key management is essential for asymmetric systems (D).

Question 12

1. SHA-256
2. SHA-3
3. MD5 (correct answer)
4. BLAKE2

Explanation: MD5 has well-known collision vulnerabilities - it is computationally feasible to produce two different inputs with the same MD5 hash - making it cryptographically broken for security applications. Answer C is correct. SHA-256 (A), SHA-3 (B), and BLAKE2 (D) are current, secure hashing algorithms.

Question 13

1. A method that uses a public key to encrypt data and a private key to decrypt it.
2. A method that generates a unique one-way hash of data that cannot be reversed.
3. A method that uses two mathematically related keys where data encrypted with one can only be decrypted with the other.
4. A method that uses the same secret key for both encryption and decryption. (correct answer)

Explanation: Symmetric encryption uses a single shared key for both encryption and decryption. It is fast but requires secure key exchange between parties. Answer D is correct. Answer A describes asymmetric encryption. Answer B describes hashing. Answer C also describes asymmetric encryption (public/private key pair).

Question 14

1. MD5 hashes are too long to store efficiently in a database.
2. Hashed credit card numbers cannot be used for any business purpose.
3. The hashes cannot be reversed, so the credit card numbers are permanently inaccessible.
4. MD5 is cryptographically broken and unsalted hashes are vulnerable to rainbow table attacks, potentially exposing card numbers. (correct answer)

Explanation: MD5 is a broken algorithm, and without salting, attackers can use precomputed rainbow tables to reverse-lookup card numbers (limited digit sets are especially vulnerable). Answer D is correct. MD5 hashes are compact (A). Hashed tokens can still serve as references (B). MD5 collision vulnerabilities and rainbow tables make reversal feasible for structured data (C).

Question 15

1. A healthcare organization transmits patient records from its hospital system to a remote billing service provider over the internet. (correct answer)
2. A company stores employee tax forms on an internal file server accessible only within its corporate network.
3. An organization archives financial records on encrypted backup tapes stored in an offsite vault.
4. A bank stores customer account numbers in an encrypted database on its internal server.

Explanation: Transmitting sensitive data over the internet requires encryption in transit to protect it from interception. TLS or similar protocols secure data moving between systems. Answer A is correct. Internal file storage (B), archived tapes (C), and internal database storage (D) all describe data at rest scenarios, not data in transit.

Question 16

1. Encrypting data as it is transmitted between the database server and application servers.
2. Encrypting data as it is processed in memory by the database engine.
3. Encrypting backup tapes before shipping them to an offsite storage facility.
4. Encrypting data stored on disk so it is unreadable without the decryption key, even if the physical media is accessed. (correct answer)

Explanation: Encryption at rest protects data stored on physical or virtual storage media - databases, files, disks - ensuring it cannot be read without the decryption key, even if the media is accessed directly. Answer D is correct. Data in transit encryption (A) is separate. In-memory encryption (B) is a different concept. Backup tape encryption (C) is a subset but not the complete definition.

Question 17

1. Bind a public key to the identity of its owner, allowing others to verify the authenticity of the public key. (correct answer)
2. Encrypt a private key so it can be safely transmitted over the internet.
3. Store encrypted copies of all passwords used by an organization.
4. Generate symmetric encryption keys for bulk data encryption.

Explanation: A digital certificate, issued by a Certificate Authority (CA), binds a public key to an identity, enabling relying parties to trust that the public key genuinely belongs to the stated entity. Answer A is correct. Private keys are not transmitted (B). Certificates do not store passwords (C). Symmetric key generation is a separate function (D).

Question 18

1. The cloud provider encrypts data on its servers and manages all encryption keys.
2. Data is only encrypted during transmission to the cloud provider's servers.
3. The customer encrypts data before uploading it to the cloud, holding the encryption keys so the provider cannot access the plaintext data. (correct answer)
4. The cloud provider and customer share encryption key management responsibilities equally.

Explanation: Client-side encryption means the customer encrypts data locally before uploading, retaining sole control of encryption keys so the cloud provider stores only ciphertext and cannot access the actual data. Answer C is correct. Provider-managed encryption (A) gives the provider key access. Transmission-only encryption (B) leaves stored data unprotected. Shared key management (D) is a different model.

Question 19

1. Encrypting the entire message with the recipient's public key.
2. Hashing the message and encrypting the hash with the recipient's public key.
3. Encrypting the message with a shared symmetric key known to both sender and recipient.
4. Hashing the message and encrypting the hash with the sender's private key. (correct answer)

Explanation: A digital signature is created by hashing the message content and encrypting the hash with the sender's private key. Recipients verify the signature by decrypting with the sender's public key and comparing the hash. Answer D is correct. Encrypting with the recipient's public key (A, B) provides confidentiality, not authentication. Symmetric keys (C) do not provide non-repudiation.

Question 20

1. Make passwords longer and harder for employees to remember.
2. Encrypt passwords using a symmetric key before hashing.
3. Enable IT administrators to recover forgotten passwords.
4. Prevent attackers from using precomputed hash tables (rainbow tables) to crack passwords by adding a unique random value to each password before hashing. (correct answer)

Explanation: A salt is a unique random value added to each password before hashing, making identical passwords produce different hashes and rendering precomputed rainbow table attacks ineffective. Answer D is correct. Salting does not affect password length for users (A), involve symmetric encryption (B), or enable password recovery (C).