A multinational e-commerce company must comply with both PCI-DSS and GDPR. They store payment card data and personal data of EU citizens. They are designing a new data storage system. Which cryptographic strategy best satisfies both regulatory requirements?

Use hashing for all data to avoid encryption overhead

Encrypt all data at rest and in transit, and implement key management controls

Encrypt data only during transmission, as storage is not a concern

Encrypt only payment card data, as GDPR does not require encryption

A multinational company stores employee records that include names, addresses, and social security numbers. They must comply with GDPR and protect this data. Which category of data is this, and what is the primary cryptographic requirement?

PII; encrypt at rest and in transit

Intellectual property; hash the data

Cardholder data; encrypt only during transmission

What is the primary advantage of quantum cryptography over classical cryptography?

It provides security based on the laws of physics rather than computational assumptions

It uses shorter keys that are easier to manage

It eliminates the need for encryption algorithms entirely

It is faster to implement on existing networks

A software vendor distributes a patch update. Users need to verify that the patch was not modified after release and that it genuinely came from the vendor. Which cryptographic mechanism should be used to provide both integrity and authenticity?

A hash value published on the vendor's website

A message authentication code (MAC) using a shared secret

Symmetric encryption of the patch

A digital signature applied by the vendor

A security team is designing a system to encrypt sensitive files. They have a choice between using a hardware security module (HSM) that generates keys with high entropy, or a software-based generator that is faster but uses a PRNG with a predictable seed. The system must balance security and performance. Which approach should they take?

Use the software generator for all keys to maximize performance

Use the HSM only for initial key generation and then reuse keys

Use the software generator for non-critical keys and the HSM for critical keys

Use the HSM for all key generation, accepting the performance impact

Systems Security Certified Practitioner

Domain 5Objective 1

5.1 - Understand Reasons and Requirements for Cryptography SSCP Practice Questions (Page 1)

Part of the Cryptography domain, which accounts for 9% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

6concepts

9%of the exam

Questions 1–5

1expert · hard
A multinational e-commerce company must comply with both PCI-DSS and GDPR. They store payment card data and personal data of EU citizens. They are designing a new data storage system. Which cryptographic strategy best satisfies both regulatory requirements?
Select an answer first
2application · medium
A multinational company stores employee records that include names, addresses, and social security numbers. They must comply with GDPR and protect this data. Which category of data is this, and what is the primary cryptographic requirement?
Select an answer first
3foundation · easy
What is the primary advantage of quantum cryptography over classical cryptography?
Select an answer first
4application · medium
A software vendor distributes a patch update. Users need to verify that the patch was not modified after release and that it genuinely came from the vendor. Which cryptographic mechanism should be used to provide both integrity and authenticity?
Select an answer first
5expert · hard
A security team is designing a system to encrypt sensitive files. They have a choice between using a hardware security module (HSM) that generates keys with high entropy, or a software-based generator that is faster but uses a PRNG with a predictable seed. The system must balance security and performance. Which approach should they take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.