Encryption at Rest and in Transit CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has a microservices architecture where service A calls service B over a private network. The security team wants to ensure that the API calls are encrypted and that service B can verify that the call is genuinely from service A. Which mechanism should be used?

   • AAn IPsec VPN between the two services.
   • BMutual TLS (mTLS) with certificates for both services.
   • CA shared symmetric key embedded in both services' configuration.
   • DTLS with only a server certificate on service B.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company processes credit card data and must comply with PCI DSS. The compliance team wants to ensure that cardholder data is protected both when stored and when transmitted over the network. Which combination of controls should they implement?

   • AUse only TLS for all data transmissions and rely on network segmentation to protect stored data.
   • BEncrypt cardholder data at rest using strong encryption and use TLS for all transmissions of cardholder data over open networks.
   • CEncrypt data at rest with a weak algorithm to reduce performance impact and use no encryption in transit.
   • DUse a VPN for all internal communications and store data in plaintext.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company runs a cloud database that stores customer PII. The security team wants to encrypt the data at rest without requiring changes to the application code. They also want to use a customer-managed key that can be rotated. Which approach should they choose?

   • AEnable transparent data encryption (TDE) on the database and store the key in the provider's key management service with customer-managed key rotation.
   • BUse a VPN to encrypt traffic between the application and the database.
   • CImplement application-level encryption by modifying the application to encrypt data before writing to the database.
   • DEncrypt the database backup files only.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement about asymmetric encryption is true?

   • AIt only uses a private key for both operations
   • BIt uses the same key for encryption and decryption
   • CIt is faster than symmetric encryption
   • DIt uses a pair of keys: a public key and a private key
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a common method to encrypt data at rest in cloud block storage?

   • AEncrypting only the file names
   • BUsing volume-level encryption
   • CUsing a checksum for each block
   • DEncrypting only the metadata
   Reveal Solution Discussion Select an answer first