CPA Quiz: Assess Encryption And Data Protection Methods
20 questions · exam conditions
0:00
Assess Encryption And Data Protection MethodsQuestion 1 of 20

An organization implements a hardware security module (HSM) for cryptographic operations. The primary purpose of an HSM is to:

Encrypt all network traffic between the organization's data centers.
Store backup copies of the organization's databases in an encrypted format.
Monitor user access to encrypted files and generate access logs.
Securely generate, store, and manage cryptographic keys in tamper-resistant hardware, preventing key exposure even to administrators.
← Back to quizzes

CPA Quiz

CPA Quiz: Assess Encryption And Data Protection Methods

Practice Assess Encryption And Data Protection Methods in CPA with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Assess Encryption And Data Protection Methods, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

An organization implements a hardware security module (HSM) for cryptographic operations. The primary purpose of an HSM is to:

  1. Encrypt all network traffic between the organization's data centers.
  2. Store backup copies of the organization's databases in an encrypted format.
  3. Monitor user access to encrypted files and generate access logs.
  4. Securely generate, store, and manage cryptographic keys in tamper-resistant hardware, preventing key exposure even to administrators. (correct answer)
Explanation: An HSM is a dedicated hardware device that performs cryptographic operations and stores keys in a tamper-resistant environment, ensuring keys are never exposed in plaintext outside the HSM. Answer D is correct. Network traffic encryption (A), database backup (B), and access monitoring (C) are not HSM functions.

Question 2

A legacy app needs reversible encrypted SSNs to stay 9 digits. Best choice?

  1. AES-256-CBC with random IV
  2. Format-preserving encryption (correct answer)
  3. Unsalted SHA-256 hashing
  4. Vault-based tokenization
Explanation: Format-preserving encryption is the best fit: it encrypts a 9-digit SSN directly into another 9-digit value that can be decrypted with the key, so you keep both reversibility and the fixed format. Vault-based tokenization is the tempting wrong choice because it also preserves 9-digit values and is reversible, but it isn't encryption: it swaps the SSN for a surrogate token stored in a vault, so it doesn't meet the encrypted-SSN requirement.

Question 3

Which property does ECDHE preserve after a server key compromise?

  1. Continued server availability
  2. Future session integrity
  3. Past session confidentiality (correct answer)
  4. Strong client authentication
Explanation: ECDHE uses ephemeral key pairs, so each session's shared secret is discarded after the handshake. If the server's long-term key is later compromised, an attacker cannot recover old session keys, so past session confidentiality remains intact. The tempting error is future session integrity: a compromised server key does allow impersonation going forward, but forward secrecy is about protecting sessions that already happened.

Question 4

To trust a sender's digitally signed hash, what must you validate first?

  1. Sender's private key is secret
  2. Session key was exchanged
  3. Hash algorithm is strong
  4. Sender's certificate chain (correct answer)
Explanation: To trust a digitally signed hash, you need the sender's public key and proof that it really belongs to that sender. That proof comes from validating the sender's certificate chain up to a trusted root. The tempting wrong answer is that the hash algorithm must be strong, but even a strong hash is useless if you cannot trust the signer's identity and public key.

Question 5

A DB column using AES-GCM with a random nonce cannot support equality lookups because:

  1. Ciphertext is probabilistic (correct answer)
  2. The nonce is too short
  3. GCM lacks authentication
  4. The key is not exportable
Explanation: Because AES-GCM with a random nonce produces a different ciphertext for the same plaintext each time, equality lookups fail: identical values no longer match byte-for-byte. A tempting wrong answer is that GCM lacks authentication, but GCM is an authenticated encryption mode. The nonce's purpose is uniqueness, not enabling equality comparisons.

Question 6

A stolen backup contains encrypted data. Which key design best limits exposure?

  1. Unique data key, KEK-wrapped (correct answer)
  2. One AES key reused everywhere
  3. Key derived from a password
  4. Master key stored beside DEKs
Explanation: A unique data key wrapped by a key-encryption key means the stolen backup holds only an encrypted DEK, so without the KEK the data stays protected. Reusing one AES key everywhere or storing a master key beside the DEKs makes a single theft expose everything. A password-derived key is weaker because passwords can be guessed.

Question 7

Tokenization as a data protection technique differs from encryption in that:

  1. Tokenization uses stronger mathematical algorithms than encryption.
  2. Tokenization replaces sensitive data with a non-sensitive placeholder (token) with no mathematical relationship to the original data, requiring a secure token vault to retrieve the original. (correct answer)
  3. Tokenization is reversible using publicly available tools without a key.
  4. Tokenization can only be applied to numeric data fields such as credit card numbers.
Explanation: Tokenization substitutes a sensitive value with a random token stored in a separate secure vault; unlike encryption, there is no algorithm to reverse a token without accessing the vault. Answer B is correct. Tokenization is not mathematically stronger or weaker than encryption (A). It requires vault access to reverse (C). It applies to various data types (D).

Question 8

Which of the following represents the most significant risk of using outdated or weak encryption algorithms (such as DES or RC4)?

  1. Outdated algorithms require more processing power, slowing down systems.
  2. Advances in computing power make weak algorithms vulnerable to brute-force or known attacks, potentially exposing encrypted data. (correct answer)
  3. Outdated algorithms are not compatible with modern operating systems.
  4. Regulatory agencies may assess fines for using non-standard encryption, regardless of actual security impact.
Explanation: Weak encryption algorithms (DES, RC4) have known vulnerabilities or insufficient key lengths that modern computing power can exploit, making the encrypted data recoverable by attackers. Answer B is correct. Performance (A) is a secondary concern. Compatibility (C) may be an issue but is not the primary risk. Regulatory fines (D) may result but are a consequence of the security risk, not the risk itself.

Question 9

Which of the following statements about asymmetric encryption is correct?

  1. Asymmetric encryption uses the same key for both encryption and decryption, making it more secure than symmetric encryption.
  2. Asymmetric encryption uses a mathematically related key pair; data encrypted with one key can only be decrypted with the other key in the pair. (correct answer)
  3. Asymmetric encryption is faster than symmetric encryption and is therefore preferred for encrypting large volumes of data.
  4. Asymmetric encryption does not require key management since keys are generated on demand for each transaction.
Explanation: Asymmetric encryption uses a key pair - public and private - where data encrypted with the public key can only be decrypted with the private key and vice versa. Answer B is correct. Asymmetric uses different keys, not the same key (A). It is significantly slower than symmetric (C). Key management is essential for asymmetric systems (D).

Question 10

Which of the following best describes symmetric encryption?

  1. A method that uses a public key to encrypt data and a private key to decrypt it.
  2. A method that generates a unique one-way hash of data that cannot be reversed.
  3. A method that uses two mathematically related keys where data encrypted with one can only be decrypted with the other.
  4. A method that uses the same secret key for both encryption and decryption. (correct answer)
Explanation: Symmetric encryption uses a single shared key for both encryption and decryption. It is fast but requires secure key exchange between parties. Answer D is correct. Answer A describes asymmetric encryption. Answer B describes hashing. Answer C also describes asymmetric encryption (public/private key pair).

Question 11

An e-commerce company stores hashed credit card numbers in its database instead of actual card numbers. A security assessor determines that the hashes were generated without salting using MD5. Which of the following is the most significant security concern?

  1. MD5 hashes are too long to store efficiently in a database.
  2. Hashed credit card numbers cannot be used for any business purpose.
  3. The hashes cannot be reversed, so the credit card numbers are permanently inaccessible.
  4. MD5 is cryptographically broken and unsalted hashes are vulnerable to rainbow table attacks, potentially exposing card numbers. (correct answer)
Explanation: MD5 is a broken algorithm, and without salting, attackers can use precomputed rainbow tables to reverse-lookup card numbers (limited digit sets are especially vulnerable). Answer D is correct. MD5 hashes are compact (A). Hashed tokens can still serve as references (B). MD5 collision vulnerabilities and rainbow tables make reversal feasible for structured data (C).

Question 12

A company discovers that an employee has been emailing customer financial data to a personal email account. Which of the following data protection controls would have been most effective at preventing this?

  1. A data loss prevention (DLP) policy that blocks or quarantines outbound emails containing sensitive financial data patterns. (correct answer)
  2. Full-disk encryption on the employee's workstation.
  3. Multi-factor authentication for email system access.
  4. Regular backup of the company's email server.
Explanation: DLP policies can inspect outbound email content for sensitive data patterns and block or alert on transmissions of customer financial data. Answer A is correct. Full-disk encryption (B) protects stored data but not emails sent from the device. MFA (C) prevents unauthorized login but not insider data exfiltration by authorized users. Backups (D) provide recovery, not prevention.

Question 13

Which of the following represents a key management best practice?

  1. Storing encryption keys in the same location as the encrypted data to simplify recovery.
  2. Storing encryption keys separately from the encrypted data and rotating keys on a defined schedule. (correct answer)
  3. Using the same encryption key for all systems and data types to simplify management.
  4. Sharing encryption keys with all employees who might need access to encrypted data.
Explanation: Key management best practice requires storing keys separately from encrypted data (compromising both together defeats encryption), rotating keys periodically to limit exposure, and controlling key access tightly. Answer B is correct. Storing keys with data (A) undermines encryption. Using one key everywhere (C) means a single compromise exposes all data. Broad key sharing (D) eliminates access control.

Question 14

A Certificate Authority (CA) in a PKI system is responsible for:

  1. Generating symmetric encryption keys for each secure communication session.
  2. Storing encrypted copies of all private keys issued to users.
  3. Monitoring network traffic for unauthorized use of digital certificates.
  4. Issuing, validating, and revoking digital certificates that bind public keys to verified identities. (correct answer)
Explanation: A CA is the trusted third party that issues digital certificates after verifying the identity of the applicant, and maintains certificate revocation lists (CRLs) for compromised or expired certificates. Answer D is correct. CAs do not generate symmetric keys (A), store private keys (B), or monitor network traffic (C).

Question 15

Which of the following hashing algorithms is considered cryptographically broken and should not be used for security-sensitive applications?

  1. SHA-256
  2. SHA-3
  3. MD5 (correct answer)
  4. BLAKE2
Explanation: MD5 has well-known collision vulnerabilities - it is computationally feasible to produce two different inputs with the same MD5 hash - making it cryptographically broken for security applications. Answer C is correct. SHA-256 (A), SHA-3 (B), and BLAKE2 (D) are current, secure hashing algorithms.

Question 16

An organization's policy requires 'encryption at rest' for all databases containing personally identifiable information (PII). Which of the following best describes 'encryption at rest'?

  1. Encrypting data as it is transmitted between the database server and application servers.
  2. Encrypting data as it is processed in memory by the database engine.
  3. Encrypting backup tapes before shipping them to an offsite storage facility.
  4. Encrypting data stored on disk so it is unreadable without the decryption key, even if the physical media is accessed. (correct answer)
Explanation: Encryption at rest protects data stored on physical or virtual storage media - databases, files, disks - ensuring it cannot be read without the decryption key, even if the media is accessed directly. Answer D is correct. Data in transit encryption (A) is separate. In-memory encryption (B) is a different concept. Backup tape encryption (C) is a subset but not the complete definition.

Question 17

A company's cloud storage provider offers 'client-side encryption.' What does this mean for data security?

  1. The cloud provider encrypts data on its servers and manages all encryption keys.
  2. Data is only encrypted during transmission to the cloud provider's servers.
  3. The customer encrypts data before uploading it to the cloud, holding the encryption keys so the provider cannot access the plaintext data. (correct answer)
  4. The cloud provider and customer share encryption key management responsibilities equally.
Explanation: Client-side encryption means the customer encrypts data locally before uploading, retaining sole control of encryption keys so the cloud provider stores only ciphertext and cannot access the actual data. Answer C is correct. Provider-managed encryption (A) gives the provider key access. Transmission-only encryption (B) leaves stored data unprotected. Shared key management (D) is a different model.

Question 18

A digital signature is created by:

  1. Encrypting the entire message with the recipient's public key.
  2. Hashing the message and encrypting the hash with the recipient's public key.
  3. Encrypting the message with a shared symmetric key known to both sender and recipient.
  4. Hashing the message and encrypting the hash with the sender's private key. (correct answer)
Explanation: A digital signature is created by hashing the message content and encrypting the hash with the sender's private key. Recipients verify the signature by decrypting with the sender's public key and comparing the hash. Answer D is correct. Encrypting with the recipient's public key (A, B) provides confidentiality, not authentication. Symmetric keys (C) do not provide non-repudiation.

Question 19

A company uses TLS (Transport Layer Security) to protect data transmitted between its web application and users' browsers. This control primarily addresses which security concern?

  1. Protecting data stored on the company's database servers from unauthorized access.
  2. Protecting data in transit from interception and tampering by encrypting communications between the client and server. (correct answer)
  3. Preventing unauthorized users from logging into the web application.
  4. Ensuring that the web application code is free from vulnerabilities.
Explanation: TLS encrypts data as it travels across the network, protecting it from interception (eavesdropping) and modification (man-in-the-middle attacks) during transmission. Answer B is correct. TLS does not protect stored data (A), manage authentication (C), or secure application code (D).

Question 20

Which of the following correctly describes the primary difference between encryption and hashing?

  1. Encryption is faster than hashing and is therefore preferred for all data protection use cases.
  2. Hashing uses a key while encryption does not.
  3. Encryption is reversible with the appropriate key; hashing is a one-way function that cannot be reversed. (correct answer)
  4. Hashing protects data in transit while encryption protects data at rest.
Explanation: Encryption transforms data in a reversible way using a key; decryption recovers the original. Hashing produces a fixed-length digest that cannot be reversed to recover the original data. Answer C is correct. Speed comparison (A) is not the defining difference. Hashing typically does not use a secret key (B). Both can apply to data at rest or in transit (D).