Data Encryption Techniques NDE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary reason hybrid encryption is used in protocols like TLS?

   • ATo provide stronger encryption than either method alone.
   • BTo combine the speed of symmetric encryption with the secure key exchange of asymmetric encryption.
   • CTo use two different symmetric keys for each direction of communication.
   • DTo eliminate the need for key exchange entirely.
   Reveal Solution Discussion Select an answer first
2. 37application · easy

   A company is deploying a web application that handles sensitive customer data. The application must encrypt data in transit between the user's browser and the web server. Which technology should the administrator implement?

   • AFull-disk encryption on the web server
   • BTLS with a valid certificate from a trusted CA
   • CA digital signature on each HTTP response
   • DA VPN tunnel between the user's browser and the web server
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A satellite communication system transmits telemetry data in short, intermittent bursts. The system has very limited computational resources and cannot afford to buffer data into blocks. The data is not highly sensitive but must be protected from casual eavesdropping. Which encryption approach is most appropriate?

   • AUse AES in ECB mode.
   • BUse a lightweight stream cipher with a unique nonce per transmission.
   • CUse no encryption because the data is not highly sensitive.
   • DUse a block cipher in CBC mode with a fixed IV.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is deploying a remote-access VPN for employees. The VPN must support strong authentication and encryption. The security team is considering using TLS-based VPN (such as OpenVPN) versus IPsec. The company has a mix of legacy devices that do not support IPsec. Which solution is most appropriate?

   • AUse a site-to-site VPN instead of remote access
   • BUse a proprietary VPN protocol that is not based on TLS or IPsec
   • CUse IPsec because it is more secure than TLS
   • DUse a TLS-based VPN because it can traverse firewalls and works on devices that may not support IPsec
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security architect is designing encryption for a high-throughput data pipeline that processes millions of small records per second. The pipeline runs on commodity hardware. The architect must choose between a block cipher in GCM mode and a stream cipher like ChaCha20. The data is not authenticated by another layer. Which consideration is most important in this decision?

   • AChaCha20 is a stream cipher and does not require padding, making it more efficient for small records
   • BGCM requires a unique IV per encryption, which is difficult to guarantee at high throughput
   • CChaCha20 is faster on hardware without AES-NI, but GCM is faster on hardware with AES-NI
   • DGCM provides authenticated encryption, which is essential because the data is not authenticated elsewhere
   Reveal Solution Discussion Select an answer first