Cryptography Concepts for Managers GSLC Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   When evaluating cryptographic controls from a management perspective, what is the primary purpose of conducting a risk assessment?

   • ATo determine which cryptographic algorithms are fastest
   • BTo identify and prioritize risks to data confidentiality, integrity, and availability
   • CTo select the most expensive encryption solution
   • DTo ensure all employees are trained on cryptographic concepts
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A software vendor distributes a critical security patch. To allow customers to verify that the patch came from the vendor and was not tampered with during download, the vendor publishes a hash of the patch file and signs that hash with its private key. What does this process provide to the customer?

   • AConfidentiality of the patch contents and integrity of the patch file.
   • BIntegrity of the patch file and authentication of the vendor.
   • CNon-repudiation of the patch's distribution and confidentiality of the patch contents.
   • DAuthentication of the vendor and confidentiality of the patch contents.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company is implementing a system to securely store and transmit medical records. The system must ensure that records are not altered, that only authorized personnel can access them, and that the organization can prove who accessed what and when. Which combination of cryptographic controls best meets these requirements?

   • AHashing for integrity, encryption for confidentiality, and access control lists for authorization.
   • BDigital signatures for integrity, encryption for confidentiality, and biometric authentication for access.
   • CEncryption for confidentiality, digital signatures for integrity and authentication, and audit logging for accountability.
   • DEncryption for confidentiality, hashing for integrity, and digital signatures for authentication.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A financial institution uses a hardware security module (HSM) to store the private keys used for signing transactions. The security team wants to ensure that if one administrator leaves, the keys remain protected and usable. Which key management practice is most important to implement?

   • AStore the keys in a software vault with a strong passphrase known only to the security team lead.
   • BImplement split knowledge and dual control so that no single individual has full access to the keys.
   • CRotate the keys annually and update all certificates that use them.
   • DBack up the keys to a secure offsite location and store the backup in the cloud.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security manager is evaluating whether to migrate from a legacy on-premises encryption system to a cloud-based key management service (KMS). The legacy system is fully paid for, but the cloud KMS offers better audit capabilities and automated key rotation. The organization has a limited budget and must maintain compliance with a regulation that requires key rotation every 90 days. What is the best decision?

   • ANegotiate with the regulator to extend the rotation period.
   • BKeep the legacy system because it is already paid for.
   • CMigrate to the cloud KMS because automated rotation reduces the risk of non-compliance.
   • DUse the legacy system but manually rotate keys every 90 days.
   Reveal Solution Discussion Select an answer first