What is the primary purpose of encryption in protecting data?

To ensure data integrity by detecting unauthorized modifications

To verify the identity of the sender of a message

To permanently delete data from storage media

To convert plaintext into ciphertext so that unauthorized parties cannot read the data

A government contractor must encrypt data at rest and in transit. The compliance standard requires the use of a NIST-approved algorithm with a minimum key length of 128 bits for symmetric encryption and 2048 bits for asymmetric. Which combination of algorithms meets these requirements?

AES-128 for data at rest and RSA-2048 for key exchange in TLS.

Blowfish-64 for data at rest and ECC-256 for key exchange.

3DES-168 for data at rest and RSA-1024 for key exchange.

DES-56 for data at rest and RSA-1024 for key exchange.

A multinational company must comply with GDPR for data stored in the EU and with a local law in Country X that requires all encryption keys to be stored within Country X. The company uses a global KMS that stores keys in the US. Which approach should the tester recommend to satisfy both requirements?

Encrypt all data with a single key stored in the US and rely on GDPR's adequacy decisions.

Deploy a separate KMS instance in Country X for keys used to encrypt data stored in Country X.

Use client-side encryption with keys stored on user devices.

Use the global KMS for all data and accept the risk of non-compliance.

A tester is analyzing a smart card authentication system. The card uses ECC with a 256-bit key. The tester observes that the time taken to sign a message varies significantly depending on the private key value. Which attack is the tester most likely to pursue?

A timing side-channel attack to recover the private key.

A brute-force attack on the 256-bit key space.

A birthday attack to find a collision in the hash function.

A padding oracle attack to decrypt the message.

Certified Tester Security Tester

Domain 5Objective 3

Encryption CT-SEC Practice Questions (Page 3)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

Questions 11–15

11foundation · easy
What is the primary purpose of encryption in protecting data?
Select an answer first
12application · medium
A government contractor must encrypt data at rest and in transit. The compliance standard requires the use of a NIST-approved algorithm with a minimum key length of 128 bits for symmetric encryption and 2048 bits for asymmetric. Which combination of algorithms meets these requirements?
Select an answer first
13expert · hard
A multinational company must comply with GDPR for data stored in the EU and with a local law in Country X that requires all encryption keys to be stored within Country X. The company uses a global KMS that stores keys in the US. Which approach should the tester recommend to satisfy both requirements?
Select an answer first
14expert · hard
A tester is analyzing a smart card authentication system. The card uses ECC with a 256-bit key. The tester observes that the time taken to sign a message varies significantly depending on the private key value. Which attack is the tester most likely to pursue?
Select an answer first
15foundation · easy
Which of the following is a common asymmetric encryption algorithm?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.

Encryption CT-SEC Practice Questions (Page 3)

Questions 11–15

What is the primary purpose of encryption in protecting data?

A government contractor must encrypt data at rest and in transit. The compliance standard requires the use of a NIST-approved algorithm with a minimum key length of 128 bits for symmetric encryption and 2048 bits for asymmetric. Which combination of algorithms meets these requirements?

A tester is analyzing a smart card authentication system. The card uses ECC with a 256-bit key. The tester observes that the time taken to sign a message varies significantly depending on the private key value. Which attack is the tester most likely to pursue?

Which of the following is a common asymmetric encryption algorithm?

Keep studying — Testing Security Mechanisms