A hospital stores patient records in a cloud database and also sends them to a research lab via a public network. The compliance officer requires that data be encrypted both at rest and in transit. Which solution set meets both requirements?

Use IPsec for the transfer and store data in plaintext

Encrypt the data at rest but send it in plaintext over the VPN

Enable database encryption (TDE) and use TLS for the data transfer

Use only TLS for the transfer and rely on the cloud provider's physical security

A healthcare organization needs to send a signed electronic prescription from a doctor to a pharmacy. The requirement is that the pharmacy can verify the prescription truly came from the doctor and was not altered. What should the doctor use to sign the document?

A symmetric key shared with the pharmacy

A small company needs to encrypt files stored on a shared network drive. They want a solution that is fast for large files and requires minimal administrative overhead. Which approach best meets these needs?

Use SHA-256 to scramble the file contents

Use ECC with a different key for each user

Use RSA-2048 to encrypt each file individually

Use AES-256 with a shared key distributed to authorized users

Why might an organization need to consider export controls when implementing encryption?

Because some encryption technologies may be subject to restrictions when exported to certain countries.

To comply with data protection laws that require encryption of personal data.

To ensure encryption keys are stored in a specific country.

To ensure that encryption algorithms are publicly available.

A company's internal CA has been compromised, and an attacker issued a rogue certificate for the company's domain. The company uses certificate pinning in its mobile app. What is the most effective immediate mitigation?

Disable certificate validation in the app

Revoke the rogue certificate and update the app's pinned public key

Switch to symmetric encryption for the app

Wait for the certificate to expire

EC-CouncilAssociate C|CISO

Domain 4Objective 6

Encryption ACCISO Practice Questions (Page 6)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 26–30

26expert · hard
A hospital stores patient records in a cloud database and also sends them to a research lab via a public network. The compliance officer requires that data be encrypted both at rest and in transit. Which solution set meets both requirements?
Select an answer first
27application · medium
A healthcare organization needs to send a signed electronic prescription from a doctor to a pharmacy. The requirement is that the pharmacy can verify the prescription truly came from the doctor and was not altered. What should the doctor use to sign the document?
Select an answer first
28application · medium
A small company needs to encrypt files stored on a shared network drive. They want a solution that is fast for large files and requires minimal administrative overhead. Which approach best meets these needs?
Select an answer first
29foundation · easy
Why might an organization need to consider export controls when implementing encryption?
Select an answer first
30expert · hard
A company's internal CA has been compromised, and an attacker issued a rogue certificate for the company's domain. The company uses certificate pinning in its mobile app. What is the most effective immediate mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.