CompTIA Security+ SY0-701 Cryptography and PKI Practice Test

 

Topic 04 focuses on Cryptography and PKI for the CompTIA Security+ certification and the SY0-701 exam, using practical cybersecurity scenarios aligned to the published Security+ objectives. For broader exam preparation, review the CompTIA Security+ SY0-701 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which term describes encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data?

1. Digital signature
2. Certificate signing request (CSR)
3. Certificate revocation list (CRL)
4. Symmetric encryption

Correct Answer: D

 

Correct Answer

Answer D is correct because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.

Incorrect Answers

Answer A is incorrect because Digital signature would fit a different scenario. Digital signature refers to a cryptographic value created with a private key and verified with the corresponding public key.

Answer B is incorrect because Certificate signing request (CSR) addresses a different requirement. Certificate signing request (CSR) refers to a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance.

Answer C is incorrect because Certificate revocation list (CRL) represents a different security function. Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration.

 

Question 2

To enable secure operations without sharing the private key, which security approach should be selected?

1. Symmetric encryption
2. Certificate revocation list (CRL)
3. Key exchange
4. Asymmetric encryption

Correct Answer: D

 

Correct Answer

Answer D is correct because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.

Incorrect Answers

Answer A is incorrect because Symmetric encryption addresses a different security requirement. Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.

Answer B is incorrect because Certificate revocation list (CRL) addresses a different requirement. Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration.

Answer C is incorrect because Key exchange would fit a different scenario. Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network.

 

Question 3

Which method lets parties establish or agree on cryptographic key material over an untrusted network?

1. Key exchange
2. Root of trust
3. Public key infrastructure
4. Digital signature

Correct Answer: A

 

Correct Answer

Answer A is correct because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network.

Incorrect Answers

Answer B is incorrect because Root of trust addresses a different requirement. Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.

Answer C is incorrect because Public key infrastructure would fit a different scenario. Public key infrastructure refers to the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.

Answer D is incorrect because Digital signature represents a different security function. Digital signature refers to a cryptographic value created with a private key and verified with the corresponding public key.

 

Question 4

To detect changes to data without needing to decrypt or recover the original input, which security approach should be selected?

1. Digital signature
2. Hashing
3. Symmetric encryption
4. Key exchange

Correct Answer: B

 

Correct Answer

Answer B is correct because Hashing means a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity.

Incorrect Answers

Answer A is incorrect because Digital signature would fit a different scenario. Digital signature refers to a cryptographic value created with a private key and verified with the corresponding public key.

Answer C is incorrect because Symmetric encryption addresses a different requirement. Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.

Answer D is incorrect because Key exchange addresses a different security requirement. Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network.

 

Question 5

Which term describes adding unique random data to a password before hashing it?

1. Key stretching
2. Salting
3. Symmetric encryption
4. Wildcard certificate

Correct Answer: B

 

Correct Answer

Answer B is correct because Salting means adding unique random data to a password before hashing it.

Incorrect Answers

Answer A is incorrect because Key stretching would fit a different scenario. Key stretching refers to a technique that deliberately increases the computational cost of deriving a key from a password.

Answer C is incorrect because Symmetric encryption represents a different security function. Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.

Answer D is incorrect because Wildcard certificate addresses a different requirement. Wildcard certificate refers to a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com.

 

Question 6

To provide integrity, origin authentication, and strong evidence of authorship, which security approach should be selected?

1. Public key
2. Key management system
3. Public key infrastructure
4. Digital signature

Correct Answer: D

 

Correct Answer

Answer D is correct because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key.

Incorrect Answers

Answer A is incorrect because Public key would fit a different scenario. Public key refers to the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder.

Answer B is incorrect because Key management system addresses a different security requirement. Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.

Answer C is incorrect because Public key infrastructure addresses a different requirement. Public key infrastructure refers to the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.

 

Question 7

Which technique deliberately increases the computational cost of deriving a key from a password?

1. Key stretching
2. Steganography
3. Online Certificate Status Protocol (OCSP)
4. Key exchange

Correct Answer: A

 

Correct Answer

Answer A is correct because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password.

Incorrect Answers

Answer B is incorrect because Steganography represents a different security function. Steganography refers to the concealment of information inside another apparently ordinary medium.

Answer C is incorrect because Online Certificate Status Protocol (OCSP) addresses a different requirement. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

Answer D is incorrect because Key exchange would fit a different scenario. Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network.

 

Question 8

To protect data at rest on a lost or stolen endpoint, which security approach should be selected?

1. Certificate signing request (CSR)
2. Full-disk encryption
3. Digital signature
4. Key stretching

Correct Answer: B

 

Correct Answer

Answer B is correct because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking.

Incorrect Answers

Answer A is incorrect because Certificate signing request (CSR) addresses a different requirement. Certificate signing request (CSR) refers to a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance.

Answer C is incorrect because Digital signature would fit a different scenario. Digital signature refers to a cryptographic value created with a private key and verified with the corresponding public key.

Answer D is incorrect because Key stretching addresses a different security requirement. Key stretching refers to a technique that deliberately increases the computational cost of deriving a key from a password.

 

Question 9

Which term describes encryption applied to communications while data moves between endpoints?

1. Transport encryption
2. Salting
3. Secure enclave
4. Root of trust

Correct Answer: A

 

Correct Answer

Answer A is correct because Transport encryption means encryption applied to communications while data moves between endpoints.

Incorrect Answers

Answer B is incorrect because Salting would fit a different scenario. Salting refers to adding unique random data to a password before hashing it.

Answer C is incorrect because Secure enclave addresses a different requirement. Secure enclave refers to an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment.

Answer D is incorrect because Root of trust represents a different security function. Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.

 

Question 10

To establish scalable trust for certificate-based authentication and encryption, which security approach should be selected?

1. Secure enclave
2. Hashing
3. Public key infrastructure
4. Key management system

Correct Answer: C

 

Correct Answer

Answer C is correct because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.

Incorrect Answers

Answer A is incorrect because Secure enclave addresses a different requirement. Secure enclave refers to an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment.

Answer B is incorrect because Hashing would fit a different scenario. Hashing refers to a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity.

Answer D is incorrect because Key management system addresses a different security requirement. Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.

 

Question 11

What is the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder?

1. Root of trust
2. Public key
3. Trusted Platform Module (TPM)
4. Key management system

Correct Answer: B

 

Correct Answer

Answer B is correct because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder.

Incorrect Answers

Answer A is incorrect because Root of trust addresses a different requirement. Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.

Answer C is incorrect because Trusted Platform Module (TPM) represents a different security function. Trusted Platform Module (TPM) refers to a hardware-backed security component that can protect keys and attest to platform state.

Answer D is incorrect because Key management system would fit a different scenario. Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.

 

Question 12

To decrypt protected material or create digital signatures, which security approach should be selected?

1. Symmetric encryption
2. Wildcard certificate
3. Private key
4. Public key infrastructure

Correct Answer: C

 

Correct Answer

Answer C is correct because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner.

Incorrect Answers

Answer A is incorrect because Symmetric encryption addresses a different security requirement. Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.

Answer B is incorrect because Wildcard certificate addresses a different requirement. Wildcard certificate refers to a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com.

Answer D is incorrect because Public key infrastructure would fit a different scenario. Public key infrastructure refers to the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.

 

Question 13

Which term describes controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances?

1. Symmetric encryption
2. Key escrow
3. Transport encryption
4. Online Certificate Status Protocol (OCSP)

Correct Answer: B

 

Correct Answer

Answer B is correct because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances.

Incorrect Answers

Answer A is incorrect because Symmetric encryption would fit a different scenario. Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.

Answer C is incorrect because Transport encryption addresses a different requirement. Transport encryption refers to encryption applied to communications while data moves between endpoints.

Answer D is incorrect because Online Certificate Status Protocol (OCSP) represents a different security function. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

 

Question 14

To bind cryptographic material to a device and strengthen boot or credential security, which security approach should be selected?

1. Key management system
2. Hashing
3. Key stretching
4. Trusted Platform Module (TPM)

Correct Answer: D

 

Correct Answer

Answer D is correct because Trusted Platform Module (TPM) means a hardware-backed security component that can protect keys and attest to platform state.

Incorrect Answers

Answer A is incorrect because Key management system addresses a different security requirement. Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.

Answer B is incorrect because Hashing addresses a different requirement. Hashing refers to a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity.

Answer C is incorrect because Key stretching would fit a different scenario. Key stretching refers to a technique that deliberately increases the computational cost of deriving a key from a password.

 

Question 15

Which dedicated tamper-resistant device is used to generate, protect, and perform operations with high-value cryptographic keys?

1. Digital signature
2. Hardware security module (HSM)
3. Public key
4. Key exchange

Correct Answer: B

 

Correct Answer

Answer B is correct because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys.

Incorrect Answers

Answer A is incorrect because Digital signature represents a different security function. Digital signature refers to a cryptographic value created with a private key and verified with the corresponding public key.

Answer C is incorrect because Public key addresses a different requirement. Public key refers to the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder.

Answer D is incorrect because Key exchange would fit a different scenario. Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network.

 

Question 16

To manage many encryption keys consistently and audibly, which security approach should be selected?

1. Root of trust
2. Steganography
3. Certificate revocation list (CRL)
4. Key management system

Correct Answer: D

 

Correct Answer

Answer D is correct because Key management system means a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.

Incorrect Answers

Answer A is incorrect because Root of trust would fit a different scenario. Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.

Answer B is incorrect because Steganography addresses a different security requirement. Steganography refers to the concealment of information inside another apparently ordinary medium.

Answer C is incorrect because Certificate revocation list (CRL) addresses a different requirement. Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration.

 

Question 17

Which isolated protected execution area is used to keep sensitive code or cryptographic material separate from the normal operating environment?

1. Tokenization
2. Certificate authority
3. Secure enclave
4. Key exchange

Correct Answer: C

 

Correct Answer

Answer C is correct because Secure enclave means an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment.

Incorrect Answers

Answer A is incorrect because Tokenization would fit a different scenario. Tokenization refers to replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system.

Answer B is incorrect because Certificate authority represents a different security function. Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates.

Answer D is incorrect because Key exchange addresses a different requirement. Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network.

 

Question 18

To hide the existence of a message rather than simply encrypting its content, which security approach should be selected?

1. Certificate authority
2. Salting
3. Tokenization
4. Steganography

Correct Answer: D

 

Correct Answer

Answer D is correct because Steganography means the concealment of information inside another apparently ordinary medium.

Incorrect Answers

Answer A is incorrect because Certificate authority addresses a different security requirement. Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates.

Answer B is incorrect because Salting addresses a different requirement. Salting refers to adding unique random data to a password before hashing it.

Answer C is incorrect because Tokenization would fit a different scenario. Tokenization refers to replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system.

 

Question 19

A payment system replaces sensitive values with non-sensitive surrogates whose meaning depends on a protected mapping service. Which data-protection approach is being applied?

1. Symmetric encryption
2. Tokenization
3. Data masking
4. Online Certificate Status Protocol (OCSP)

Correct Answer: B

 

Correct Answer

Answer B is correct because Tokenization means replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system.

Incorrect Answers

Answer A is incorrect because Symmetric encryption would fit a different scenario. Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.

Answer C is incorrect because Data masking addresses a different requirement. Data masking refers to alteration or obscuring of sensitive values so users or systems see realistic but protected representations.

Answer D is incorrect because Online Certificate Status Protocol (OCSP) represents a different security function. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

 

Question 20

To allow testing, analytics, or support work without exposing full sensitive data, which security approach should be selected?

1. Data masking
2. Key management system
3. Root of trust
4. Asymmetric encryption

Correct Answer: A

 

Correct Answer

Answer A is correct because Data masking means alteration or obscuring of sensitive values so users or systems see realistic but protected representations.

Incorrect Answers

Answer B is incorrect because Key management system addresses a different requirement. Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.

Answer C is incorrect because Root of trust would fit a different scenario. Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.

Answer D is incorrect because Asymmetric encryption addresses a different security requirement. Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.

 

Question 21

Which trusted PKI entity validates identity according to policy and digitally signs certificates?

1. Data masking
2. Secure enclave
3. Salting
4. Certificate authority

Correct Answer: D

 

Correct Answer

Answer D is correct because Certificate authority means a trusted PKI entity that validates identity according to policy and digitally signs certificates.

Incorrect Answers

Answer A is incorrect because Data masking would fit a different scenario. Data masking refers to alteration or obscuring of sensitive values so users or systems see realistic but protected representations.

Answer B is incorrect because Secure enclave addresses a different requirement. Secure enclave refers to an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment.

Answer C is incorrect because Salting represents a different security function. Salting refers to adding unique random data to a password before hashing it.

 

Question 22

To let relying parties identify certificates that should no longer be trusted, which security approach should be selected?

1. Certificate revocation list (CRL)
2. Hashing
3. Hardware security module (HSM)
4. Steganography

Correct Answer: A

 

Correct Answer

Answer A is correct because Certificate revocation list (CRL) means a published list of certificates that a certificate authority has revoked before their scheduled expiration.

Incorrect Answers

Answer B is incorrect because Hashing addresses a different requirement. Hashing refers to a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity.

Answer C is incorrect because Hardware security module (HSM) addresses a different security requirement. Hardware security module (HSM) refers to a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys.

Answer D is incorrect because Steganography would fit a different scenario. Steganography refers to the concealment of information inside another apparently ordinary medium.

 

Question 23

Which protocol is used to query the current revocation status of a specific certificate?

1. Trusted Platform Module (TPM)
2. Steganography
3. Online Certificate Status Protocol (OCSP)
4. Certificate authority

Correct Answer: C

 

Correct Answer

Answer C is correct because Online Certificate Status Protocol (OCSP) means a protocol used to query the current revocation status of a specific certificate.

Incorrect Answers

Answer A is incorrect because Trusted Platform Module (TPM) represents a different security function. Trusted Platform Module (TPM) refers to a hardware-backed security component that can protect keys and attest to platform state.

Answer B is incorrect because Steganography would fit a different scenario. Steganography refers to the concealment of information inside another apparently ordinary medium.

Answer D is incorrect because Certificate authority addresses a different requirement. Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates.

 

Question 24

To establish the starting point for validating a trust chain, which security approach should be selected?

1. Key stretching
2. Root of trust
3. Transport encryption
4. Key exchange

Correct Answer: B

 

Correct Answer

Answer B is correct because Root of trust means a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.

Incorrect Answers

Answer A is incorrect because Key stretching would fit a different scenario. Key stretching refers to a technique that deliberately increases the computational cost of deriving a key from a password.

Answer C is incorrect because Transport encryption addresses a different security requirement. Transport encryption refers to encryption applied to communications while data moves between endpoints.

Answer D is incorrect because Key exchange addresses a different requirement. Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network.

 

Question 25

Which request containing identifying information and a public key is submitted to a certificate authority for certificate issuance?

1. Online Certificate Status Protocol (OCSP)
2. Full-disk encryption
3. Certificate signing request (CSR)
4. Key escrow

Correct Answer: C

 

Correct Answer

Answer C is correct because Certificate signing request (CSR) means a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance.

Incorrect Answers

Answer A is incorrect because Online Certificate Status Protocol (OCSP) addresses a different requirement. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

Answer B is incorrect because Full-disk encryption represents a different security function. Full-disk encryption refers to encryption that protects an entire storage device so data remains unreadable without authorized unlocking.

Answer D is incorrect because Key escrow would fit a different scenario. Key escrow refers to controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances.

 

Question 26

To cover many sibling subdomains with one certificate when policy permits, which security approach should be selected?

1. Wildcard certificate
2. Key stretching
3. Key exchange
4. Online Certificate Status Protocol (OCSP)

Correct Answer: A

 

Correct Answer

Answer A is correct because Wildcard certificate means a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com.

Incorrect Answers

Answer B is incorrect because Key stretching would fit a different scenario. Key stretching refers to a technique that deliberately increases the computational cost of deriving a key from a password.

Answer C is incorrect because Key exchange addresses a different security requirement. Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network.

Answer D is incorrect because Online Certificate Status Protocol (OCSP) addresses a different requirement. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

 

Question 27

To protect data efficiently when communicating parties can securely share one secret key, which security approach should be selected?

1. Symmetric encryption
2. Asymmetric encryption
3. Certificate revocation list (CRL)
4. Salting

Correct Answer: A

 

Correct Answer

Answer A is correct because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.

Incorrect Answers

Answer B is incorrect because Asymmetric encryption addresses a different security requirement. Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.

Answer C is incorrect because Certificate revocation list (CRL) would fit a different scenario. Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration.

Answer D is incorrect because Salting represents a different security function. Salting refers to adding unique random data to a password before hashing it.

 

Question 28

Which term describes cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange?

1. Certificate authority
2. Public key infrastructure
3. Asymmetric encryption
4. Steganography

Correct Answer: C

 

Correct Answer

Answer C is correct because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.

Incorrect Answers

Answer A is incorrect because Certificate authority addresses a different security requirement. Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates.

Answer B is incorrect because Public key infrastructure addresses a different requirement. Public key infrastructure refers to the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.

Answer D is incorrect because Steganography represents a different security function. Steganography refers to the concealment of information inside another apparently ordinary medium.

 

Question 29

To create a shared secret for later encrypted communication, which security approach should be selected?

1. Full-disk encryption
2. Certificate revocation list (CRL)
3. Key exchange
4. Root of trust

Correct Answer: C

 

Correct Answer

Answer C is correct because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network.

Incorrect Answers

Answer A is incorrect because Full-disk encryption addresses a different security requirement. Full-disk encryption refers to encryption that protects an entire storage device so data remains unreadable without authorized unlocking.

Answer B is incorrect because Certificate revocation list (CRL) would fit a different scenario. Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration.

Answer D is incorrect because Root of trust represents a different security function. Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.

 

Question 30

Which one-way transformation produces a fixed-length digest and is commonly used to verify integrity?

1. Trusted Platform Module (TPM)
2. Key escrow
3. Hashing
4. Public key infrastructure

Correct Answer: C

 

Correct Answer

Answer C is correct because Hashing means a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity.

Incorrect Answers

Answer A is incorrect because Trusted Platform Module (TPM) addresses a different requirement. Trusted Platform Module (TPM) refers to a hardware-backed security component that can protect keys and attest to platform state.

Answer B is incorrect because Key escrow addresses a different security requirement. Key escrow refers to controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances.

Answer D is incorrect because Public key infrastructure represents a different security function. Public key infrastructure refers to the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.

 

Question 31

To make identical passwords produce different hashes and weaken precomputed cracking attacks, which security approach should be selected?

1. Salting
2. Key management system
3. Hardware security module (HSM)
4. Steganography

Correct Answer: A

 

Correct Answer

Answer A is correct because Salting means adding unique random data to a password before hashing it.

Incorrect Answers

Answer B is incorrect because Key management system represents a different security function. Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.

Answer C is incorrect because Hardware security module (HSM) would fit a different scenario. Hardware security module (HSM) refers to a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys.

Answer D is incorrect because Steganography addresses a different security requirement. Steganography refers to the concealment of information inside another apparently ordinary medium.

 

Question 32

Which cryptographic value is created with a private key and verified with the corresponding public key?

1. Digital signature
2. Asymmetric encryption
3. Online Certificate Status Protocol (OCSP)
4. Key escrow

Correct Answer: A

 

Correct Answer

Answer A is correct because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key.

Incorrect Answers

Answer B is incorrect because Asymmetric encryption addresses a different requirement. Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.

Answer C is incorrect because Online Certificate Status Protocol (OCSP) represents a different security function. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

Answer D is incorrect because Key escrow addresses a different security requirement. Key escrow refers to controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances.

 

Question 33

To make password guessing more expensive for attackers, which security approach should be selected?

1. Asymmetric encryption
2. Key stretching
3. Trusted Platform Module (TPM)
4. Certificate revocation list (CRL)

Correct Answer: B

 

Correct Answer

Answer B is correct because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password.

Incorrect Answers

Answer A is incorrect because Asymmetric encryption represents a different security function. Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.

Answer C is incorrect because Trusted Platform Module (TPM) would fit a different scenario. Trusted Platform Module (TPM) refers to a hardware-backed security component that can protect keys and attest to platform state.

Answer D is incorrect because Certificate revocation list (CRL) addresses a different security requirement. Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration.

 

Question 34

Which term describes encryption that protects an entire storage device so data remains unreadable without authorized unlocking?

1. Certificate authority
2. Online Certificate Status Protocol (OCSP)
3. Asymmetric encryption
4. Full-disk encryption

Correct Answer: D

 

Correct Answer

Answer D is correct because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking.

Incorrect Answers

Answer A is incorrect because Certificate authority represents a different security function. Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates.

Answer B is incorrect because Online Certificate Status Protocol (OCSP) addresses a different security requirement. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

Answer C is incorrect because Asymmetric encryption addresses a different requirement. Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.

 

Question 35

To protect confidentiality and integrity of data in transit, which security approach should be selected?

1. Trusted Platform Module (TPM)
2. Transport encryption
3. Online Certificate Status Protocol (OCSP)
4. Public key

Correct Answer: B

 

Correct Answer

Answer B is correct because Transport encryption means encryption applied to communications while data moves between endpoints.

Incorrect Answers

Answer A is incorrect because Trusted Platform Module (TPM) addresses a different security requirement. Trusted Platform Module (TPM) refers to a hardware-backed security component that can protect keys and attest to platform state.

Answer C is incorrect because Online Certificate Status Protocol (OCSP) would fit a different scenario. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

Answer D is incorrect because Public key represents a different security function. Public key refers to the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder.

 

Question 36

What is the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates?

1. Certificate authority
2. Tokenization
3. Public key infrastructure
4. Certificate revocation list (CRL)

Correct Answer: C

 

Correct Answer

Answer C is correct because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.

Incorrect Answers

Answer A is incorrect because Certificate authority addresses a different security requirement. Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates.

Answer B is incorrect because Tokenization addresses a different requirement. Tokenization refers to replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system.

Answer D is incorrect because Certificate revocation list (CRL) represents a different security function. Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration.

 

Question 37

To allow others to perform operations that do not reveal the private key, which security approach should be selected?

1. Public key
2. Secure enclave
3. Data masking
4. Transport encryption

Correct Answer: A

 

Correct Answer

Answer A is correct because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder.

Incorrect Answers

Answer B is incorrect because Secure enclave represents a different security function. Secure enclave refers to an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment.

Answer C is incorrect because Data masking addresses a different security requirement. Data masking refers to alteration or obscuring of sensitive values so users or systems see realistic but protected representations.

Answer D is incorrect because Transport encryption would fit a different scenario. Transport encryption refers to encryption applied to communications while data moves between endpoints.

 

Question 38

Which secret half of an asymmetric key pair must remain controlled by its owner?

1. Online Certificate Status Protocol (OCSP)
2. Key management system
3. Private key
4. Tokenization

Correct Answer: C

 

Correct Answer

Answer C is correct because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner.

Incorrect Answers

Answer A is incorrect because Online Certificate Status Protocol (OCSP) addresses a different requirement. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.

Answer B is incorrect because Key management system addresses a different security requirement. Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.

Answer D is incorrect because Tokenization represents a different security function. Tokenization refers to replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system.

 

Question 39

To recover encrypted data when business or legal policy requires access to a key, which security approach should be selected?

1. Data masking
2. Certificate authority
3. Asymmetric encryption
4. Key escrow

Correct Answer: D

 

Correct Answer

Answer D is correct because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances.

Incorrect Answers

Answer A is incorrect because Data masking would fit a different scenario. Data masking refers to alteration or obscuring of sensitive values so users or systems see realistic but protected representations.

Answer B is incorrect because Certificate authority represents a different security function. Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates.

Answer C is incorrect because Asymmetric encryption addresses a different security requirement. Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.

 

Question 40

Which hardware-backed security component can protect keys and attest to platform state?

1. Transport encryption
2. Public key
3. Online Certificate Status Protocol (OCSP)
4. Trusted Platform Module (TPM)

Correct Answer: D

 

Correct Answer

Answer D is correct because Trusted Platform Module (TPM) means a hardware-backed security component that can protect keys and attest to platform state.

Incorrect Answers

Answer A is incorrect because Transport encryption addresses a different requirement. Transport encryption refers to encryption applied to communications while data moves between endpoints.

Answer B is incorrect because Public key represents a different security function. Public key refers to the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder.

Answer C is incorrect because Online Certificate Status Protocol (OCSP) addresses a different security requirement. Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate.