Encryption at Rest and in Transit CSE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company uses envelope encryption with a cloud KMS. They need to rotate the key encryption key (KEK) annually for compliance, but they have millions of objects encrypted with the current KEK. They want to minimize the operational overhead and avoid re-encrypting all objects. Which approach should they take?

   • ADownload all objects, decrypt them with the old KEK, and re-encrypt them with a new KEK.
   • BKeep the same KEK and only rotate the DEKs for new objects.
   • CCreate a new KEK version in the KMS and configure the KMS to re-wrap the existing data encryption keys (DEKs) with the new KEK version.
   • DDisable the old KEK and create a new KEK, then update all applications to use the new KEK.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A security architect is designing a system where a client application sends sensitive data to a server. The data is large, and the server must authenticate the client. The architect wants to minimize CPU overhead on the client while ensuring that the data is encrypted and the client is authenticated. Which approach should they choose?

   • AUse a VPN with IPsec and no additional authentication
   • BUse symmetric encryption with a pre-shared key and no authentication
   • CUse TLS with client certificates for authentication and symmetric encryption for the data
   • DUse asymmetric encryption for the entire data payload
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is an advantage of client-side encryption?

   • AIt is always faster than server-side encryption
   • BThe cloud provider never sees the plaintext data
   • CIt requires no key management
   • DIt eliminates the need for encryption in transit
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What does TLS provide for data in transit?

   • ACompression of data to reduce bandwidth
   • BEncryption and integrity protection
   • COnly authentication, without encryption
   • DOnly encryption, without integrity checks
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is a key characteristic of symmetric encryption?

   • AIt uses a single shared key for both encryption and decryption
   • BIt does not require a key to decrypt
   • CIt uses a public key for encryption and a private key for decryption
   • DIt is always slower than asymmetric encryption
   Reveal Solution Discussion Select an answer first