Cryptography Concepts for Managers GSLC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary role of a certificate authority (CA) in a Public Key Infrastructure (PKI)?

   • ATo encrypt all network traffic between clients and servers
   • BTo store all encrypted data in a central repository
   • CTo generate and manage the private keys for all users in the organization
   • DTo issue and digitally sign digital certificates that bind a public key to an identity
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services company is subject to regulations that require encryption of customer data both at rest and in transit. The company also must be able to prove to auditors that encryption is properly implemented. Which combination of controls best supports compliance?

   • AImplementing encryption for data at rest and in transit, and maintaining documentation of key management procedures and audit logs.
   • BEncrypting all data with a single master key to simplify management.
   • CUsing only strong encryption algorithms and key lengths.
   • DRelying on the cloud provider's encryption features without additional controls.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization's encryption keys are stored on a server that is also used for general file sharing. The security manager is concerned about unauthorized access to the keys. What is the best control to implement?

   • AEncrypt the keys with a password and store them in the same folder.
   • BMove keys to a dedicated hardware security module (HSM) with strict access controls.
   • CGive all employees read access to the keys for transparency.
   • DRename the key files to obscure their purpose.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A multinational company must comply with the EU General Data Protection Regulation (GDPR) when transferring personal data of EU citizens to a subsidiary in a non-EU country. The company's security team proposes using strong encryption for the data in transit and at rest. Which additional measure is necessary to meet GDPR requirements for international data transfers?

   • AEnsuring that all encryption keys are stored within the EU.
   • BObtaining explicit consent from each data subject for the transfer.
   • CImplementing a data transfer mechanism such as Standard Contractual Clauses (SCCs) or an adequacy decision.
   • DUsing a virtual private network (VPN) to connect the two offices.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare organization needs to encrypt data transmitted between its main data center and a remote clinic over the public internet. The data includes patient records that must remain confidential during transit. The organization also needs to ensure that only the clinic's server can decrypt the data, and that the clinic can verify the data was not altered in transit. Which approach best meets these requirements?

   • AUse a pre-shared symmetric key distributed out-of-band to both sites, and use a hash of the data for integrity checking.
   • BUse a VPN tunnel with IPsec using a pre-shared key, and rely on the tunnel's built-in integrity checking.
   • CUse asymmetric encryption to encrypt the data with the clinic's public key, and sign the data with the data center's private key.
   • DUse a hybrid approach: encrypt the data with a random symmetric key, encrypt that key with the clinic's public key, and sign the hash of the data with the data center's private key.
   Reveal Solution Discussion Select an answer first