A security tester is reviewing a web application that uses TLS for transport security and stores user passwords using bcrypt. The application also encrypts sensitive user documents at rest using AES-256-GCM. During the review, the tester notices that the server's private key for TLS is stored on the same filesystem as the encrypted documents, with permissions set to 644. Which recommendation should the tester prioritize?

Switch from bcrypt to SHA-256 for password hashing to reduce computational overhead.

Disable TLS and rely solely on application-layer encryption for all data in transit.

Replace AES-256-GCM with RSA-4096 for document encryption to improve key security.

Restrict the TLS private key file permissions and move it to a hardware security module (HSM) or dedicated key store.

Which of the following is a method to test the effectiveness of an encryption implementation?

Ensuring that the encryption process is slow to increase security

Checking that the encryption key is stored in plaintext in the configuration file

Confirming that the encryption key is the same for all users

Verifying that the encryption algorithm is not deprecated and uses an adequate key length

Which of the following is a typical use case for asymmetric encryption?

Encrypting large files stored on a local disk

Ensuring data integrity in a database

Hashing passwords for storage in a database

Secure exchange of a symmetric session key over an untrusted network

Why is regular key rotation important in encryption key management?

To reduce the risk of key compromise by limiting the amount of data encrypted with a single key

To increase the speed of encryption operations

To ensure that all keys are stored in a hardware security module (HSM)

To make the encryption algorithm stronger

Certified Tester Security Tester

Domain 5Objective 3

Encryption CT-SEC Practice Questions (Page 2)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

Questions 6–10

6application · medium
A security tester is reviewing a web application that uses TLS for transport security and stores user passwords using bcrypt. The application also encrypts sensitive user documents at rest using AES-256-GCM. During the review, the tester notices that the server's private key for TLS is stored on the same filesystem as the encrypted documents, with permissions set to 644. Which recommendation should the tester prioritize?
Select an answer first
7foundation · easy
Which of the following is an example of an encryption standard that a tester might need to verify compliance with?
Select an answer first
8foundation · easy
Which of the following is a method to test the effectiveness of an encryption implementation?
Select an answer first
9foundation · easy
Which of the following is a typical use case for asymmetric encryption?
Select an answer first
10foundation · easy
Why is regular key rotation important in encryption key management?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Encryption CT-SEC Practice Questions (Page 2)

Questions 6–10

Which of the following is an example of an encryption standard that a tester might need to verify compliance with?

Which of the following is a method to test the effectiveness of an encryption implementation?

Which of the following is a typical use case for asymmetric encryption?

Why is regular key rotation important in encryption key management?

Keep studying — Testing Security Mechanisms