3.3 Architect Infrastructure and System Cryptographic Solutions ISSAP Practice Questions (Page 4)

Questions 16–19

1. 16application · medium

   A security architect is evaluating cryptographic solutions for a new IoT device that will collect sensor data. The device has limited processing power and battery life. Which cryptographic approach is most suitable for this constraint?

   • AUse a symmetric algorithm with a pre-shared key (PSK) and no key exchange
   • BUse lightweight cryptographic algorithms such as AES-128 and ECC with smaller key sizes
   • CUse TLS with a full handshake for every communication session
   • DUse RSA-4096 for all encryption operations to ensure maximum security
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which phase of the key management lifecycle involves securely erasing a cryptographic key so that it can no longer be used?

   • ADistribution
   • BDestruction
   • CGeneration
   • DRotation
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security architect is designing a key management system for a large enterprise that uses multiple cloud providers. The architect must ensure that keys are managed centrally but also allow each cloud provider to use the keys for encryption operations. Which key management architecture best meets this requirement?

   • AUse a third-party key management service (KMS) that integrates with all cloud providers via APIs
   • BUse each cloud provider's native KMS and manage them separately
   • CUse a single cloud provider's KMS and require all other providers to use it
   • DStore keys on-premises and export them to each cloud provider for encryption operations
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A government agency is deploying a new system that will handle classified data. The security architect must select cryptographic algorithms that are approved for government use and plan for the secure distribution of keys to remote sites. Which algorithm and key distribution method should the architect choose?

   • ABlowfish for symmetric encryption and using a shared passphrase for all sites
   • BDES for symmetric encryption and distributing keys via email
   • CAES-256 for symmetric encryption and a public key infrastructure (PKI) for key distribution
   • DRSA-1024 for symmetric encryption and manual key exchange via courier
   Reveal Solution Discussion Select an answer first