Encryption CCISO Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What does a digital signature primarily provide?

   • AKey exchange between parties
   • BConfidentiality of the message content
   • CAuthenticity, integrity, and non-repudiation
   • DCompression of the data
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A hospital stores patient records on laptops used by field nurses. The laptops contain sensitive data and are sometimes lost or stolen. The CISO wants to protect the data at rest on these devices. Which solution should the CISO implement?

   • AFull-disk encryption using BitLocker or FileVault with a TPM.
   • BUse a cloud storage service with encryption in transit only.
   • CEncrypt only the patient records folder with a password-protected ZIP file.
   • DRequire a strong BIOS password on each laptop.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An organization is implementing a public key infrastructure (PKI) to issue certificates for internal applications. The CISO wants to ensure that certificates are issued only to authorized devices and that the process is automated. Which PKI component should be configured to meet this requirement?

   • AA registration authority (RA) that validates device identity before certificate issuance.
   • BA root certificate that is distributed to all devices.
   • CA certificate signing request (CSR) that automatically generates certificates.
   • DA certificate revocation list (CRL) that lists unauthorized devices.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security auditor discovers that an organization's encryption keys are stored in a plaintext configuration file on the application server. The auditor also notes that the same key is used for multiple applications and has not been rotated in three years. Which combination of actions should the CISO take to address the most critical risks?

   • AMove keys to a hardware security module (HSM) or key management service (KMS), use unique keys per application, and implement a key rotation policy.
   • BEncrypt the configuration file with a password and change the password annually.
   • CUse a longer key and update the configuration file with the new key.
   • DDelete the plaintext file and rely on the application's hardcoded key.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A company is migrating its encryption key management to a cloud KMS. The CISO is concerned about the risk of a cloud provider insider accessing the keys. The company's compliance team requires that the company retain exclusive control over the root of trust. Which KMS configuration should the company choose?

   • AUse a cloud-provider-managed key (AWS-managed key) for simplicity.
   • BUse a customer-managed key (CMK) stored in a cloud HSM with the customer holding the root of trust.
   • CUse a cloud KMS with automatic key rotation and no customer access.
   • DUse a customer-supplied key (SSE-C) and store the key in the application code.
   Reveal Solution Discussion Select an answer first