Data Encryption Techniques NDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company's security policy requires that encryption keys be rotated every 30 days. However, the company's backup system uses the same key to encrypt backups, and restoring old backups requires the old key. The backup administrator is concerned that rotating the key will make old backups unreadable. Which solution should be implemented?

   • AUse a key management system that retains old key versions for decryption while using the new key for encryption.
   • BDelete old keys after rotation to simplify key management.
   • CKeep the same key for backups and rotate only keys used for other data.
   • DRe-encrypt all backups with the new key immediately after rotation.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A hospital's IT department is implementing encryption for patient records. The compliance team requires that encryption keys be escrowed so that authorized personnel can access data in an emergency. However, the security team is concerned that escrowed keys could be misused. Which control should be implemented to mitigate this risk?

   • AUse a split-key scheme where multiple authorized individuals must combine their key shares to recover the escrowed key.
   • BDo not escrow keys and rely on the original key holder.
   • CStore the escrowed key in a plaintext file on a network share.
   • DGive the escrowed key to a single administrator.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A large enterprise is migrating to a cloud-based key management service (KMS). The security team requires that keys be rotated automatically every 90 days, but the application team warns that some legacy systems have hard-coded key IDs and will break if the key is rotated. Which approach balances security and operational continuity?

   • AEnable automatic key rotation but configure the KMS to support key versioning so old keys remain available for decryption.
   • BRotate keys but require all legacy systems to be updated immediately.
   • CUse the same key for encryption and decryption and never rotate it.
   • DDisable automatic rotation and manually rotate keys only when a compromise is suspected.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A real-time audio streaming service needs to encrypt a continuous, low-latency audio feed between two devices. The data arrives as a constant bitstream, and the service cannot afford the latency of buffering data into fixed-size blocks. Which encryption approach is most appropriate?

   • AUse a block cipher in CBC mode with a fixed IV.
   • BUse a stream cipher such as ChaCha20.
   • CUse a block cipher in ECB mode.
   • DUse a block cipher in CTR mode with a static nonce.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A software company is building a secure messaging app. They need to encrypt messages so that only the intended recipient can read them, but they also need to ensure that the encryption/decryption process is fast on mobile devices. Which approach should they use?

   • AHybrid encryption: generate a random symmetric key, encrypt the message with it, and encrypt the symmetric key with the recipient's public key
   • BStream cipher: encrypt the message bit-by-bit with the recipient's public key
   • CSymmetric encryption: use a fixed shared key for all users
   • DAsymmetric encryption: encrypt the entire message with the recipient's public key
   Reveal Solution Discussion Select an answer first