Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does a digital signature provide authenticity for a message?

   • ABy encrypting the entire message with the recipient's public key
   • BBy attaching a timestamp to the message
   • CBy using a shared secret key to create a message authentication code
   • DBy using the sender's private key to sign a hash of the message
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A healthcare organization stores patient records in a database and must protect them at rest to comply with HIPAA. They also need to allow authorized applications to query the data. Which approach provides the strongest protection while maintaining functionality?

   • AEnable Transparent Data Encryption (TDE) on the database and manage the keys in a hardware security module (HSM).
   • BEncrypt the entire database backup files with a password and store the password in the backup script.
   • CUse full-disk encryption on the database server and rely on the operating system to protect the data.
   • DEncrypt each column containing sensitive data using application-level encryption with keys stored in the application server's environment variables.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In symmetric encryption, how is the same key used for both encryption and decryption?

   • AThe sender and receiver each use a different key that is mathematically related
   • BA public key encrypts and a private key decrypts
   • CThe key is derived from the plaintext itself
   • DThe same secret key is shared between the sender and receiver and used for both operations
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A small business wants to encrypt files stored on a USB drive used for backups. They need a solution that is easy to manage and does not require a public key infrastructure. Which approach should they use?

   • AUse SHA-256 to encrypt the files.
   • BUse AES-256 with a strong passphrase derived through a key derivation function (KDF).
   • CUse a simple XOR cipher with a repeating key.
   • DUse RSA-2048 to encrypt the files with a public key and keep the private key on the server.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst notices that a web application is vulnerable to a padding oracle attack. The application uses CBC mode with PKCS#7 padding and provides detailed error messages when decryption fails. Which mitigation is most effective?

   • ASwitch to an authenticated encryption mode such as AES-GCM.
   • BUse a longer key, such as AES-256, to make the attack harder.
   • CUse a random IV for each encryption operation.
   • DDisable error messages and return a generic response for all decryption failures.
   Reveal Solution Discussion Select an answer first