Encryption CCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A startup is building a messaging application and wants to ensure that only the intended recipient can read messages. They plan to use a symmetric encryption algorithm. Which key management challenge must they address to ensure confidentiality?

   • AEnsuring the encryption algorithm is fast enough for real-time messaging.
   • BStoring the key in a hardware security module to prevent side-channel attacks.
   • CGenerating a unique key for each message to prevent replay attacks.
   • DSecurely distributing the shared secret key to both parties without interception.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A government agency is deploying a new system that requires encryption of classified data. The system must balance security with operational availability. The CISO is considering using a hardware security module (HSM) for key storage. Which trade-off must be addressed?

   • AHSMs are slower than software-based key storage, which will degrade system performance.
   • BHSMs provide strong key protection but can become a single point of failure if not deployed in a high-availability configuration.
   • CHSMs cannot be integrated with cloud services, limiting deployment options.
   • DHSMs require frequent key rotation, increasing operational overhead.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A government agency requires that all official documents be digitally signed to ensure authenticity and integrity. The agency also needs to ensure that a signature can be verified years after the document is created, even if the signing certificate expires. Which approach should the agency implement?

   • AEncrypt the document with the signer's public key and store the private key.
   • BHash the document and store the hash in a public database.
   • CUse a self-signed certificate for each document and keep the private key secure.
   • DUse a timestamping authority to record the time of signing and preserve the certificate chain.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company needs to encrypt large volumes of data stored in its data warehouse. The data is accessed frequently by internal applications. The CISO wants to minimize performance impact while maintaining strong security. Which encryption approach should the CISO choose?

   • AUse TLS to encrypt the data at rest in the warehouse.
   • BUse AES-256 with a symmetric key stored in a hardware security module (HSM).
   • CUse RSA-2048 to encrypt each data record individually.
   • DUse a hash function like SHA-256 to encrypt the data.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services company uses AES-256 to encrypt customer data at rest in its database. The security team recently discovered that a database administrator with access to the encryption key left the company. The CISO wants to ensure that the former administrator cannot decrypt any data that was encrypted before their departure, while minimizing operational disruption. What should the CISO direct the team to do?

   • ADelete the old key and rely on the database's automatic re-encryption on next write.
   • BChange the database administrator's password and disable their account.
   • CRotate the encryption key and re-encrypt all existing data with the new key.
   • DGenerate a new key and use it for all new data, leaving existing data encrypted with the old key.
   Reveal Solution Discussion Select an answer first