A multinational corporation uses a cloud-based key management service (KMS) to store encryption keys for its data-at-rest encryption. The CISO is concerned about the risk of a compromised KMS administrator account. The company has a regulatory requirement to be able to prove that data was encrypted at a specific point in time. Which combination of controls best addresses the CISO's concern while meeting the regulatory requirement?

Store all keys in a hardware security module (HSM) on-premises and disable remote access.

Use a single long-lived key and store it in a password manager.

Enable key versioning and audit logging in the KMS, and enforce separation of duties for key management.

Rotate keys daily and delete all old key versions immediately.

A security analyst notices that an attacker is intercepting TLS connections between users and a corporate web application by presenting a fraudulent certificate that the users' browsers accept. Which PKI weakness is most likely being exploited?

The web application's private key is too short.

The web server is using an outdated version of TLS.

The certificate revocation list (CRL) is not being checked.

A rogue CA certificate has been installed in the users' trusted root store.

A company wants to secure email communications between its employees and external partners. They decide to use S/MIME. What must be in place for S/MIME to work effectively?

All email servers must use TLS for SMTP connections.

The organization must use a PGP key server to distribute public keys.

Employees must use a specific email client that supports S/MIME.

Each user must have a digital certificate issued by a trusted CA that binds their public key to their email address.

What is the purpose of key rotation in cryptographic key management?

To increase the speed of encryption

To allow multiple users to share the same key

To limit the amount of data encrypted with a single key

A security engineer is designing a system to store user passwords. The current system uses SHA-256 without a salt. The CISO wants to improve password storage security. Which approach is most appropriate?

Use SHA-256 with a static salt for all users.

Encrypt the passwords with AES-256 and store the key in the application.

Use MD5 with a salt to reduce storage requirements.

Use a slow, salted hash function like bcrypt or PBKDF2.

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 6

Encryption CCISO Practice Questions (Page 1)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

10concepts

Questions 1–5

1expert · hard
A multinational corporation uses a cloud-based key management service (KMS) to store encryption keys for its data-at-rest encryption. The CISO is concerned about the risk of a compromised KMS administrator account. The company has a regulatory requirement to be able to prove that data was encrypted at a specific point in time. Which combination of controls best addresses the CISO's concern while meeting the regulatory requirement?
Select an answer first
2application · medium
A security analyst notices that an attacker is intercepting TLS connections between users and a corporate web application by presenting a fraudulent certificate that the users' browsers accept. Which PKI weakness is most likely being exploited?
Select an answer first
3application · medium
A company wants to secure email communications between its employees and external partners. They decide to use S/MIME. What must be in place for S/MIME to work effectively?
Select an answer first
4foundation · easy
What is the purpose of key rotation in cryptographic key management?
Select an answer first
5expert · hard
A security engineer is designing a system to store user passwords. The current system uses SHA-256 without a salt. The CISO wants to improve password storage security. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.