Which of the following is an example of a common encryption vulnerability?

Using a weak key that is easily guessable

Encrypting data with a well-known algorithm like AES

Storing keys in a hardware security module (HSM)

Using a strong, randomly generated key

What is the primary purpose of secure key storage in encryption key management?

To allow keys to be shared publicly without risk

To speed up the encryption and decryption processes

To make keys easier to remember for users

To protect encryption keys from unauthorized access and theft

A company uses a hybrid encryption scheme where each user's data is encrypted with a unique data encryption key (DEK), and the DEK is then encrypted with a master key stored in a cloud KMS. The compliance team requires that the company be able to revoke a single user's access to their data without affecting other users. Which approach should the tester recommend?

Disable the master key temporarily and re-enable it after the user is removed.

Delete the specific user's DEK from the key store.

Change the user's password and require them to re-authenticate.

Rotate the master key and re-encrypt all DEKs with the new master key.

A tester is assessing a web server's TLS configuration. The server supports TLS 1.2 and TLS 1.3. The tester wants to verify that the server is not vulnerable to downgrade attacks. Which test should the tester perform?

Attempt to connect using SSLv3 and TLS 1.0.

Verify that the server supports forward secrecy.

Verify that the server uses a valid certificate from a trusted CA.

Verify that the server uses a 2048-bit RSA key.

Why do encryption standards and compliance requirements matter to a security tester?

They are only relevant for government systems, not commercial applications

They guarantee that encryption is unbreakable

They specify the exact encryption key to be used for all systems

They define the minimum cryptographic strength and algorithms that must be used to meet regulatory obligations

Certified Tester Security Tester

Domain 5Objective 3

Encryption CT-SEC Practice Questions (Page 1)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

Questions 1–5

1foundation · easy
Which of the following is an example of a common encryption vulnerability?
Select an answer first
2foundation · easy
What is the primary purpose of secure key storage in encryption key management?
Select an answer first
3application · medium
A company uses a hybrid encryption scheme where each user's data is encrypted with a unique data encryption key (DEK), and the DEK is then encrypted with a master key stored in a cloud KMS. The compliance team requires that the company be able to revoke a single user's access to their data without affecting other users. Which approach should the tester recommend?
Select an answer first
4application · medium
A tester is assessing a web server's TLS configuration. The server supports TLS 1.2 and TLS 1.3. The tester wants to verify that the server is not vulnerable to downgrade attacks. Which test should the tester perform?
Select an answer first
5foundation · easy
Why do encryption standards and compliance requirements matter to a security tester?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.