Security+ Cryptography Quiz: 50 Practice Questions and Answers
50 questions for the Security+ SY0-701 exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
SHA-256 is a hashing algorithm.
Not this one. Try another answer.
Why B is wrong
Diffie-Hellman is a key exchange method.
Right, C is the answer.
Why C is right
AES is the standard symmetric block cipher for bulk data encryption.
Not this one. Try another answer.
Why D is wrong
RSA and ECC are asymmetric.
Question 2 Play from 01:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
10 would be one key per user.
Not this one. Try another answer.
Why B is wrong
20 is the count for asymmetric key pairs.
Right, C is the answer.
Why C is right
With symmetric keys every pair needs one key: 10 times 9, divided by 2, is 45.
Not this one. Try another answer.
Why D is wrong
90 counts each pair twice.
Question 3 Play from 02:03
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Steganography hides data inside other files, so nobody suspects it is there.
Not this one. Try another answer.
Why B is wrong
Tokenization swaps data for tokens.
Not this one. Try another answer.
Why C is wrong
Data masking hides part of displayed data.
Not this one. Try another answer.
Why D is wrong
Hashing creates a one-way digest.
Question 4 Play from 03:06
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The handshake uses the certificate; it does not replace it.
Right, B is the answer.
Why B is right
Asymmetric methods prove identity and help agree a symmetric session key, which then encrypts the data.
Not this one. Try another answer.
Why C is wrong
Password hashing is unrelated to the handshake.
Not this one. Try another answer.
Why D is wrong
Bulk data is encrypted with the faster symmetric session key.
Question 5 Play from 04:23
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
ECC reaches the same strength as RSA with far smaller keys, saving processing power and battery.
Not this one. Try another answer.
Why B is wrong
ECC is not a hashing algorithm.
Not this one. Try another answer.
Why C is wrong
ECC uses a key pair.
Not this one. Try another answer.
Why D is wrong
ECC is asymmetric.
Question 6 Play from 05:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A wildcard covers subdomains of one domain only.
Right, B is the answer.
Why B is right
The Subject Alternative Name field lists every name the certificate is valid for.
Not this one. Try another answer.
Why C is wrong
The expiration date sets validity time.
Not this one. Try another answer.
Why D is wrong
A serial number identifies the certificate.
Question 7 Play from 06:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A CRL is the full downloaded list.
Not this one. Try another answer.
Why B is wrong
A CSR requests a certificate.
Right, C is the answer.
Why C is right
The Online Certificate Status Protocol returns good, revoked or unknown for one certificate.
Not this one. Try another answer.
Why D is wrong
HMAC checks message integrity.
Question 8 Play from 07:45
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Key stretching makes each password guess expensive, slowing brute-force attacks.
Not this one. Try another answer.
Why B is wrong
Steganography hides data inside other files.
Not this one. Try another answer.
Why C is wrong
Key escrow stores key copies with a third party.
Not this one. Try another answer.
Why D is wrong
Salting adds a random value, not repeated rounds.
Question 9 Play from 08:54
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Symmetric encryption is far more efficient for large amounts of data.
Not this one. Try another answer.
Why B is wrong
A shared key cannot prove which side sent data.
Not this one. Try another answer.
Why C is wrong
Strength depends on the algorithm and key length.
Not this one. Try another answer.
Why D is wrong
Symmetric encryption needs a shared key.
Question 10 Play from 10:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Reversible processes with keys are encryption.
Not this one. Try another answer.
Why B is wrong
Hiding data in images is steganography.
Not this one. Try another answer.
Why C is wrong
Hash output length is fixed.
Right, D is the answer.
Why D is right
A hash cannot be reversed, and its output length stays the same for any input.
Show all 50 questionsShow fewer questions
Question 11 Play from 11:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Steganography hides data inside files.
Not this one. Try another answer.
Why B is wrong
Tokenization replaces stored values.
Right, C is the answer.
Why C is right
TLS encrypts data as it moves across the network.
Not this one. Try another answer.
Why D is wrong
Full-disk encryption protects data at rest.
Question 12 Play from 12:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
MD5 is a hash, not asymmetric encryption.
Not this one. Try another answer.
Why B is wrong
MD5 is actually very fast.
Right, C is the answer.
Why C is right
Attackers can make two different inputs with the same MD5 hash, so it cannot prove integrity.
Not this one. Try another answer.
Why D is wrong
MD5 uses no keys.
Question 13 Play from 13:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
AES-256 is the modern replacement.
Right, B is the answer.
Why B is right
DES uses a 56-bit key that can be brute-forced; AES replaced it.
Not this one. Try another answer.
Why C is wrong
ECC is a current asymmetric method.
Not this one. Try another answer.
Why D is wrong
SHA-256 is a current hash.
Question 14 Play from 14:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An HSM is a separate high-capacity device for many systems.
Not this one. Try another answer.
Why B is wrong
A KMS is a service for managing keys at scale.
Not this one. Try another answer.
Why C is wrong
A CA issues certificates.
Right, D is the answer.
Why D is right
A TPM is built into the device and protects keys used for boot integrity and disk encryption.
Question 15 Play from 15:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tokenization replaces data with tokens.
Not this one. Try another answer.
Why B is wrong
Data masking hides part of a value on screen.
Not this one. Try another answer.
Why C is wrong
Key stretching repeats hashing to slow guessing.
Right, D is the answer.
Why D is right
A salt makes identical passwords hash differently and defeats precomputed rainbow tables.
Question 16 Play from 16:42
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A self-signed certificate is not a key store.
Not this one. Try another answer.
Why B is wrong
A TPM protects a single device.
Not this one. Try another answer.
Why C is wrong
A secure enclave protects data inside one processor.
Right, D is the answer.
Why D is right
An HSM is a hardened appliance or card built for high-volume key generation and storage.
Question 17 Play from 17:57
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Each user has one public and one private key, so 10 users have 20 keys.
Not this one. Try another answer.
Why B is wrong
100 has no basis here.
Not this one. Try another answer.
Why C is wrong
45 is the symmetric pairwise count.
Not this one. Try another answer.
Why D is wrong
10 counts only one key per user.
Question 18 Play from 18:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A root key anchors a trust chain and is long-lived.
Not this one. Try another answer.
Why B is wrong
An escrowed key is kept by a third party.
Right, C is the answer.
Why C is right
Ephemeral session keys limit the damage if any one key is exposed.
Not this one. Try another answer.
Why D is wrong
A CA key signs certificates and is long-lived.
Question 19 Play from 20:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A CRL is published by one CA.
Not this one. Try another answer.
Why B is wrong
PKI relies on central certificate authorities.
Not this one. Try another answer.
Why C is wrong
Key escrow is held by a trusted party.
Right, D is the answer.
Why D is right
Blockchain chains blocks with hashes, so changing one block breaks every later link.
Question 20 Play from 21:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A matching hash says nothing about whether the original was safe.
Not this one. Try another answer.
Why B is wrong
Hashing does not encrypt.
Not this one. Try another answer.
Why C is wrong
A plain hash is not a digital signature.
Right, D is the answer.
Why D is right
Matching hashes prove integrity: the file is the same as the one that was hashed.
Question 21 Play from 22:23
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Key escrow stores key copies.
Not this one. Try another answer.
Why B is wrong
OCSP stapling delivers certificate status.
Right, C is the answer.
Why C is right
Certificate pinning ties the app to a known certificate or public key, stopping on-path attackers with fake certificates.
Not this one. Try another answer.
Why D is wrong
Revocation cancels a certificate.
Question 22 Play from 23:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Obfuscation hides data; signatures do not.
Right, B is the answer.
Why B is right
A signature proves who sent the message and that it was not changed, and the sender cannot deny it.
Not this one. Try another answer.
Why C is wrong
Availability is about uptime, not signatures.
Not this one. Try another answer.
Why D is wrong
A signature does not encrypt, so it gives no confidentiality.
Question 23 Play from 24:46
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Only the private key holder can create the signature, so the sender cannot later deny it.
Not this one. Try another answer.
Why B is wrong
Anyone can compute a plain hash.
Not this one. Try another answer.
Why C is wrong
Salting only strengthens stored password hashes.
Not this one. Try another answer.
Why D is wrong
With a shared key, either party could have produced the message.
Question 24 Play from 25:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
RSA is asymmetric.
Not this one. Try another answer.
Why B is wrong
AES is a symmetric block cipher.
Right, C is the answer.
Why C is right
SHA-256 is a hashing algorithm that produces a fixed 256-bit digest.
Not this one. Try another answer.
Why D is wrong
Diffie-Hellman is a key exchange method.
Question 25 Play from 26:50
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tokenization replaces data with tokens.
Not this one. Try another answer.
Why B is wrong
Key stretching strengthens passwords.
Right, C is the answer.
Why C is right
Key escrow stores keys with a trusted party for recovery or lawful access.
Not this one. Try another answer.
Why D is wrong
Certificate pinning locks an app to a known certificate.
Question 26 Play from 27:56
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The root CA certificate is the anchor that the rest of the chain is checked against.
Not this one. Try another answer.
Why B is wrong
Wildcard describes name coverage.
Not this one. Try another answer.
Why C is wrong
The leaf is the server's own certificate at the bottom.
Not this one. Try another answer.
Why D is wrong
An intermediate is signed by the root.
Question 27 Play from 29:04
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Diffie-Hellman key exchange lets both sides calculate the same secret from values exchanged in public.
Not this one. Try another answer.
Why B is wrong
AES encrypts data but needs a key already shared.
Not this one. Try another answer.
Why C is wrong
SHA-256 is a hash.
Not this one. Try another answer.
Why D is wrong
MD5 is an old hash.
Question 28 Play from 30:16
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Masking hides part of a value but keeps the original.
Not this one. Try another answer.
Why B is wrong
Hashing cannot be mapped back.
Not this one. Try another answer.
Why C is wrong
Salting is for password hashes.
Right, D is the answer.
Why D is right
Tokenization swaps sensitive data for a meaningless token, and only the vault can map it back.
Question 29 Play from 31:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The public key is used to verify a signature.
Not this one. Try another answer.
Why B is wrong
The sender never has the recipient's private key.
Not this one. Try another answer.
Why C is wrong
The recipient's public key is used for encryption, not signing.
Right, D is the answer.
Why D is right
A signature is made with the sender's private key, so only the sender could have produced it.
Question 30 Play from 32:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
128 bits is the MD5 output length.
Not this one. Try another answer.
Why B is wrong
512 bits is the SHA-512 output length.
Not this one. Try another answer.
Why C is wrong
160 bits is the SHA-1 output length.
Right, D is the answer.
Why D is right
SHA-256 always produces a 256-bit digest, whatever the input size.
Question 31 Play from 33:34
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Volume encryption covers a whole volume.
Not this one. Try another answer.
Why B is wrong
Partition encryption covers a whole partition.
Not this one. Try another answer.
Why C is wrong
Full-disk encryption covers the whole drive.
Right, D is the answer.
Why D is right
Record-level encryption protects individual records inside a database.
Question 32 Play from 34:43
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
RSA uses a public and private key pair, for encryption and signatures.
Not this one. Try another answer.
Why B is wrong
Steganography hides data inside other files.
Not this one. Try another answer.
Why C is wrong
AES is a symmetric block cipher.
Not this one. Try another answer.
Why D is wrong
SHA-256 is a hashing algorithm.
Question 33 Play from 35:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Data masking hides part of a value from people who do not need to see all of it.
Not this one. Try another answer.
Why B is wrong
Tokenization replaces the whole value with a token.
Not this one. Try another answer.
Why C is wrong
Steganography hides data inside files.
Not this one. Try another answer.
Why D is wrong
Key stretching strengthens passwords.
Question 34 Play from 36:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Signatures use a key pair, not a shared key.
Right, B is the answer.
Why B is right
Anyone can verify a signature with the sender's public key.
Not this one. Try another answer.
Why C is wrong
The recipient's private key is for decrypting messages sent to them.
Not this one. Try another answer.
Why D is wrong
The sender's private key is never shared.
Question 35 Play from 38:05
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Alice never has Bob's private key.
Right, B is the answer.
Why B is right
Anything encrypted with Bob's public key can only be decrypted with Bob's private key, which only he holds.
Not this one. Try another answer.
Why C is wrong
Encrypting with Alice's private key is signing, which anyone can reverse with her public key.
Not this one. Try another answer.
Why D is wrong
Only Alice could decrypt with her own private key, not Bob.
Question 36 Play from 39:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A root certificate anchors a CA chain.
Right, B is the answer.
Why B is right
A wildcard certificate for star dot example.com covers every subdomain at that level.
Not this one. Try another answer.
Why C is wrong
A self-signed certificate is not trusted by browsers by default.
Not this one. Try another answer.
Why D is wrong
A code signing certificate signs software.
Question 37 Play from 40:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A session ID is not a PKI key.
Not this one. Try another answer.
Why B is wrong
CA certificates are public.
Right, C is the answer.
Why C is right
If a private key is exposed, attackers can decrypt data and sign as its owner.
Not this one. Try another answer.
Why D is wrong
The public key is meant to be shared.
Question 38 Play from 41:28
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A CRL lists revoked certificates that should no longer be trusted.
Not this one. Try another answer.
Why B is wrong
A CSR is a request for a new certificate.
Not this one. Try another answer.
Why C is wrong
Key escrow concerns stored keys.
Not this one. Try another answer.
Why D is wrong
A root store holds trusted root certificates.
Question 39 Play from 42:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A certificate issued by a trusted CA would not warn.
Right, B is the answer.
Why B is right
A self-signed certificate is not vouched for by a trusted CA, so browsers do not trust it by default.
Not this one. Try another answer.
Why C is wrong
Extended validation certificates come from public CAs.
Not this one. Try another answer.
Why D is wrong
Wildcard describes name coverage, not who signed it.
Question 40 Play from 43:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Steganography hides data.
Not this one. Try another answer.
Why B is wrong
Tokenization replaces sensitive values.
Not this one. Try another answer.
Why C is wrong
Salting strengthens stored password hashes.
Right, D is the answer.
Why D is right
A hash-based message authentication code proves both integrity and that the sender knew the key.
Question 41 Play from 44:58
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
SSL 3.0 has known weaknesses and should be turned off in favour of modern TLS.
Not this one. Try another answer.
Why B is wrong
TLS 1.3 is the current version.
Not this one. Try another answer.
Why C is wrong
AES-256 is a strong cipher, not a protocol version.
Not this one. Try another answer.
Why D is wrong
TLS 1.2 is still acceptable when well configured.
Question 42 Play from 46:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The private key must never leave the server.
Not this one. Try another answer.
Why B is wrong
An OCSP response is a status answer.
Not this one. Try another answer.
Why C is wrong
A CRL lists revoked certificates.
Right, D is the answer.
Why D is right
A CSR contains the public key and identity details; the private key stays on the server.
Question 43 Play from 47:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A CRL is a downloaded list of revoked certificates.
Right, B is the answer.
Why B is right
OCSP stapling saves clients a lookup and protects their privacy.
Not this one. Try another answer.
Why C is wrong
Key escrow stores key copies.
Not this one. Try another answer.
Why D is wrong
Pinning locks an app to a known certificate.
Question 44 Play from 48:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Key escrow stores copies of keys with a third party.
Right, B is the answer.
Why B is right
Perfect forward secrecy uses a new ephemeral key for each session, so old sessions stay safe.
Not this one. Try another answer.
Why C is wrong
OCSP stapling speeds up certificate status checks.
Not this one. Try another answer.
Why D is wrong
Key stretching strengthens weak passwords.
Question 45 Play from 49:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A key escrow agent holds key copies.
Not this one. Try another answer.
Why B is wrong
A CA issues certificates.
Right, C is the answer.
Why C is right
A secure enclave is an isolated part of the processor that the main OS cannot read.
Not this one. Try another answer.
Why D is wrong
An HSM is a separate device.
Question 46 Play from 50:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A wildcard secures web subdomains.
Right, B is the answer.
Why B is right
A code signing certificate proves the publisher and the integrity of software.
Not this one. Try another answer.
Why C is wrong
A self-signed web certificate is untrusted and meant for web servers.
Not this one. Try another answer.
Why D is wrong
An email certificate protects email.
Question 47 Play from 51:55
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Symmetric encryption shares one secret key between both sides.
Not this one. Try another answer.
Why B is wrong
Digital signing uses a private key to sign and a public key to verify.
Not this one. Try another answer.
Why C is wrong
Asymmetric encryption uses a public and private key pair.
Not this one. Try another answer.
Why D is wrong
Hashing is one-way and uses no decryption key.
Question 48 Play from 52:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
An OCSP responder answers status queries.
Not this one. Try another answer.
Why B is wrong
A CSR is the request sent to a CA.
Right, C is the answer.
Why C is right
The CA verifies identities and signs certificates with its private key.
Not this one. Try another answer.
Why D is wrong
A CRL lists revoked certificates.
Question 49 Play from 54:07
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A TPM protects keys on one device.
Right, B is the answer.
Why B is right
A KMS centralises the key lifecycle: creation, rotation, access control and retirement.
Not this one. Try another answer.
Why C is wrong
A CRL lists revoked certificates.
Not this one. Try another answer.
Why D is wrong
Steganography hides data inside other files.
Question 50 Play from 55:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Transport encryption protects data in transit, not at rest.
Right, B is the answer.
Why B is right
Full-disk encryption protects the entire drive, including the operating system and temporary files.
Not this one. Try another answer.
Why C is wrong
File-level encryption only covers chosen files.
Not this one. Try another answer.
Why D is wrong
Record-level encryption is for database records.
Transcript
Play from 00:00 Question 1. What is AES? Here are the options. Option A. A hashing algorithm. Option B. A key exchange protocol. Option C. A symmetric block cipher. Option D. An asymmetric algorithm. Pause the video now if you want time to think about the answer.
The correct answer is C. A symmetric block cipher. AES is the standard symmetric block cipher for bulk data encryption. Now, why are the other options incorrect? Option A is incorrect. SHA-256 is a hashing algorithm. Option B is incorrect. Diffie-Hellman is a key exchange method. Option D is incorrect. RSA and ECC are asymmetric. Therefore, C, A symmetric block cipher, is the correct answer.
Play from 01:04 Question 2. Ten users each need a unique symmetric key for every pair of users. How many keys are needed? Here are the options. Option A. 10. Option B. 20. Option C. 45. Option D. 90. Pause the video now if you want time to think about the answer.
The correct answer is C. 45. With symmetric keys every pair needs one key: 10 times 9, divided by 2, is 45. Now, why are the other options incorrect? Option A is incorrect. 10 would be one key per user. Option B is incorrect. 20 is the count for asymmetric key pairs. Option D is incorrect. 90 counts each pair twice. Therefore, C, 45, is the correct answer.
Play from 02:03 Question 3. An attacker hides a secret message inside the pixels of a normal looking photo. What technique is this? Here are the options. Option A. Steganography. Option B. Tokenization. Option C. Data masking. Option D. Hashing. Pause the video now if you want time to think about the answer.
The correct answer is A. Steganography. Steganography hides data inside other files, so nobody suspects it is there. Now, why are the other options incorrect? Option B is incorrect. Tokenization swaps data for tokens. Option C is incorrect. Data masking hides part of displayed data. Option D is incorrect. Hashing creates a one-way digest. Therefore, A, Steganography, is the correct answer.
Show full transcriptShow less
Play from 03:06 Question 4. In a TLS handshake, what is asymmetric cryptography mainly used for? Here are the options. Option A. Replacing the certificate. Option B. Authenticating the server and setting up the session key. Option C. Hashing stored passwords. Option D. Encrypting all the bulk data. Pause the video now if you want time to think about the answer.
The correct answer is B. Authenticating the server and setting up the session key. Asymmetric methods prove identity and help agree a symmetric session key, which then encrypts the data. Now, why are the other options incorrect? Option A is incorrect. The handshake uses the certificate; it does not replace it. Option C is incorrect. Password hashing is unrelated to the handshake. Option D is incorrect. Bulk data is encrypted with the faster symmetric session key. Therefore, B, Authenticating the server and setting up the session key, is the correct answer.
Play from 04:23 Question 5. Why is elliptic curve cryptography popular on phones and IoT devices? Here are the options. Option A. It gives strong security with much shorter keys. Option B. It is a hashing algorithm. Option C. It needs no keys at all. Option D. It is a symmetric algorithm. Pause the video now if you want time to think about the answer.
The correct answer is A. It gives strong security with much shorter keys. ECC reaches the same strength as RSA with far smaller keys, saving processing power and battery. Now, why are the other options incorrect? Option B is incorrect. ECC is not a hashing algorithm. Option C is incorrect. ECC uses a key pair. Option D is incorrect. ECC is asymmetric. Therefore, A, It gives strong security with much shorter keys, is the correct answer.
Play from 05:33 Question 6. One certificate must cover several different domain names, such as example.com and example.net. What field makes this possible? Here are the options. Option A. Wildcard. Option B. Subject Alternative Name. Option C. Expiration date. Option D. Serial number. Pause the video now if you want time to think about the answer.
The correct answer is B. Subject Alternative Name. The Subject Alternative Name field lists every name the certificate is valid for. Now, why are the other options incorrect? Option A is incorrect. A wildcard covers subdomains of one domain only. Option C is incorrect. The expiration date sets validity time. Option D is incorrect. A serial number identifies the certificate. Therefore, B, Subject Alternative Name, is the correct answer.
Play from 06:39 Question 7. Which protocol lets a client check the status of one certificate in real time, without downloading a full list? Here are the options. Option A. CRL. Option B. CSR. Option C. OCSP. Option D. HMAC. Pause the video now if you want time to think about the answer.
The correct answer is C. OCSP. The Online Certificate Status Protocol returns good, revoked or unknown for one certificate. Now, why are the other options incorrect? Option A is incorrect. A CRL is the full downloaded list. Option B is incorrect. A CSR requests a certificate. Option D is incorrect. HMAC checks message integrity. Therefore, C, OCSP, is the correct answer.
Play from 07:45 Question 8. Algorithms like PBKDF2 and bcrypt hash a password thousands of times to slow attackers down. What is this called? Here are the options. Option A. Key stretching. Option B. Steganography. Option C. Key escrow. Option D. Salting. Pause the video now if you want time to think about the answer.
The correct answer is A. Key stretching. Key stretching makes each password guess expensive, slowing brute-force attacks. Now, why are the other options incorrect? Option B is incorrect. Steganography hides data inside other files. Option C is incorrect. Key escrow stores key copies with a third party. Option D is incorrect. Salting adds a random value, not repeated rounds. Therefore, A, Key stretching, is the correct answer.
Play from 08:54 Question 9. In TLS, why is a symmetric cipher used for the bulk of the data? Here are the options. Option A. It is much faster than asymmetric encryption. Option B. It provides non-repudiation. Option C. It is always stronger than asymmetric encryption. Option D. It needs no keys. Pause the video now if you want time to think about the answer.
The correct answer is A. It is much faster than asymmetric encryption. Symmetric encryption is far more efficient for large amounts of data. Now, why are the other options incorrect? Option B is incorrect. A shared key cannot prove which side sent data. Option C is incorrect. Strength depends on the algorithm and key length. Option D is incorrect. Symmetric encryption needs a shared key. Therefore, A, It is much faster than asymmetric encryption, is the correct answer.
Play from 10:05 Question 10. Which statement best describes hashing? Here are the options. Option A. A reversible process that uses a secret key. Option B. A way to hide data inside an image. Option C. A process whose output grows with the input. Option D. A one-way function that produces a fixed-length output. Pause the video now if you want time to think about the answer.
The correct answer is D. A one-way function that produces a fixed-length output. A hash cannot be reversed, and its output length stays the same for any input. Now, why are the other options incorrect? Option A is incorrect. Reversible processes with keys are encryption. Option B is incorrect. Hiding data in images is steganography. Option C is incorrect. Hash output length is fixed. Therefore, D, A one-way function that produces a fixed-length output, is the correct answer.
Play from 11:13 Question 11. Which protects data in transit between a browser and a web server? Here are the options. Option A. Steganography. Option B. Tokenization. Option C. TLS. Option D. Full-disk encryption. Pause the video now if you want time to think about the answer.
The correct answer is C. TLS. TLS encrypts data as it moves across the network. Now, why are the other options incorrect? Option A is incorrect. Steganography hides data inside files. Option B is incorrect. Tokenization replaces stored values. Option D is incorrect. Full-disk encryption protects data at rest. Therefore, C, TLS, is the correct answer.
Play from 12:16 Question 12. Why is MD5 no longer trusted for security purposes? Here are the options. Option A. It is an asymmetric algorithm. Option B. It is too slow. Option C. Practical collisions can be created. Option D. It requires a private key. Pause the video now if you want time to think about the answer.
The correct answer is C. Practical collisions can be created. Attackers can make two different inputs with the same MD5 hash, so it cannot prove integrity. Now, why are the other options incorrect? Option A is incorrect. MD5 is a hash, not asymmetric encryption. Option B is incorrect. MD5 is actually very fast. Option D is incorrect. MD5 uses no keys. Therefore, C, Practical collisions can be created, is the correct answer.
Play from 13:27 Question 13. Which algorithm is outdated and should be replaced with AES? Here are the options. Option A. AES-256. Option B. DES. Option C. ECC. Option D. SHA-256. Pause the video now if you want time to think about the answer.
The correct answer is B. DES. DES uses a 56-bit key that can be brute-forced; AES replaced it. Now, why are the other options incorrect? Option A is incorrect. AES-256 is the modern replacement. Option C is incorrect. ECC is a current asymmetric method. Option D is incorrect. SHA-256 is a current hash. Therefore, B, DES, is the correct answer.
Play from 14:30 Question 14. Which chip on a laptop's motherboard stores keys and supports secure boot and full-disk encryption? Here are the options. Option A. Hardware security module. Option B. Key management system. Option C. Certificate authority. Option D. Trusted Platform Module. Pause the video now if you want time to think about the answer.
The correct answer is D. Trusted Platform Module. A TPM is built into the device and protects keys used for boot integrity and disk encryption. Now, why are the other options incorrect? Option A is incorrect. An HSM is a separate high-capacity device for many systems. Option B is incorrect. A KMS is a service for managing keys at scale. Option C is incorrect. A CA issues certificates. Therefore, D, Trusted Platform Module, is the correct answer.
Play from 15:39 Question 15. Which adds a unique random value to each password before it is hashed? Here are the options. Option A. Tokenization. Option B. Data masking. Option C. Key stretching. Option D. Salting. Pause the video now if you want time to think about the answer.
The correct answer is D. Salting. A salt makes identical passwords hash differently and defeats precomputed rainbow tables. Now, why are the other options incorrect? Option A is incorrect. Tokenization replaces data with tokens. Option B is incorrect. Data masking hides part of a value on screen. Option C is incorrect. Key stretching repeats hashing to slow guessing. Therefore, D, Salting, is the correct answer.
Play from 16:42 Question 16. A bank needs a dedicated, tamper-resistant device that generates and stores keys for many servers at high speed. What should it use? Here are the options. Option A. Self-signed certificate. Option B. Trusted Platform Module. Option C. Secure enclave. Option D. Hardware security module. Pause the video now if you want time to think about the answer.
The correct answer is D. Hardware security module. An HSM is a hardened appliance or card built for high-volume key generation and storage. Now, why are the other options incorrect? Option A is incorrect. A self-signed certificate is not a key store. Option B is incorrect. A TPM protects a single device. Option C is incorrect. A secure enclave protects data inside one processor. Therefore, D, Hardware security module, is the correct answer.
Play from 17:57 Question 17. Ten users each have their own asymmetric key pair. How many keys exist in total? Here are the options. Option A. 20. Option B. 100. Option C. 45. Option D. 10. Pause the video now if you want time to think about the answer.
The correct answer is A. 20. Each user has one public and one private key, so 10 users have 20 keys. Now, why are the other options incorrect? Option B is incorrect. 100 has no basis here. Option C is incorrect. 45 is the symmetric pairwise count. Option D is incorrect. 10 counts only one key per user. Therefore, A, 20, is the correct answer.
Play from 18:56 Question 18. A key is created for one session only and thrown away when the session ends. What is it called? Here are the options. Option A. A root key. Option B. An escrowed key. Option C. An ephemeral key. Option D. A certificate authority key. Pause the video now if you want time to think about the answer.
The correct answer is C. An ephemeral key. Ephemeral session keys limit the damage if any one key is exposed. Now, why are the other options incorrect? Option A is incorrect. A root key anchors a trust chain and is long-lived. Option B is incorrect. An escrowed key is kept by a third party. Option D is incorrect. A CA key signs certificates and is long-lived. Therefore, C, An ephemeral key, is the correct answer.
Play from 20:04 Question 19. Which technology is an open public ledger where each block is linked to the previous one by a hash, with no central authority? Here are the options. Option A. A certificate revocation list. Option B. PKI. Option C. Key escrow. Option D. Blockchain. Pause the video now if you want time to think about the answer.
The correct answer is D. Blockchain. Blockchain chains blocks with hashes, so changing one block breaks every later link. Now, why are the other options incorrect? Option A is incorrect. A CRL is published by one CA. Option B is incorrect. PKI relies on central certificate authorities. Option C is incorrect. Key escrow is held by a trusted party. Therefore, D, Blockchain, is the correct answer.
Play from 21:12 Question 20. A download page lists a SHA-256 value. What does matching it against the hash of your downloaded file show? Here are the options. Option A. The file is free of all malware. Option B. The file is encrypted. Option C. The file was signed with the vendor's private key. Option D. The file was not changed. Pause the video now if you want time to think about the answer.
The correct answer is D. The file was not changed. Matching hashes prove integrity: the file is the same as the one that was hashed. Now, why are the other options incorrect? Option A is incorrect. A matching hash says nothing about whether the original was safe. Option B is incorrect. Hashing does not encrypt. Option C is incorrect. A plain hash is not a digital signature. Therefore, D, The file was not changed, is the correct answer.
Play from 22:23 Question 21. A mobile banking app accepts only one specific certificate for its server, which blocks forged certificates. What is this? Here are the options. Option A. Key escrow. Option B. OCSP stapling. Option C. Certificate pinning. Option D. Certificate revocation. Pause the video now if you want time to think about the answer.
The correct answer is C. Certificate pinning. Certificate pinning ties the app to a known certificate or public key, stopping on-path attackers with fake certificates. Now, why are the other options incorrect? Option A is incorrect. Key escrow stores key copies. Option B is incorrect. OCSP stapling delivers certificate status. Option D is incorrect. Revocation cancels a certificate. Therefore, C, Certificate pinning, is the correct answer.
Play from 23:34 Question 22. What does a digital signature provide? Here are the options. Option A. Obfuscation of the message. Option B. Integrity, authentication and non-repudiation. Option C. Availability of the message. Option D. Confidentiality of the message. Pause the video now if you want time to think about the answer.
The correct answer is B. Integrity, authentication and non-repudiation. A signature proves who sent the message and that it was not changed, and the sender cannot deny it. Now, why are the other options incorrect? Option A is incorrect. Obfuscation hides data; signatures do not. Option C is incorrect. Availability is about uptime, not signatures. Option D is incorrect. A signature does not encrypt, so it gives no confidentiality. Therefore, B, Integrity, authentication and non-repudiation, is the correct answer.
Play from 24:46 Question 23. Which of these provides non-repudiation? Here are the options. Option A. A digital signature. Option B. A plain hash. Option C. Salting. Option D. Symmetric encryption. Pause the video now if you want time to think about the answer.
The correct answer is A. A digital signature. Only the private key holder can create the signature, so the sender cannot later deny it. Now, why are the other options incorrect? Option B is incorrect. Anyone can compute a plain hash. Option C is incorrect. Salting only strengthens stored password hashes. Option D is incorrect. With a shared key, either party could have produced the message. Therefore, A, A digital signature, is the correct answer.
Play from 25:48 Question 24. What is SHA-256? Here are the options. Option A. An asymmetric algorithm. Option B. A symmetric block cipher. Option C. A hashing algorithm. Option D. A key exchange protocol. Pause the video now if you want time to think about the answer.
The correct answer is C. A hashing algorithm. SHA-256 is a hashing algorithm that produces a fixed 256-bit digest. Now, why are the other options incorrect? Option A is incorrect. RSA is asymmetric. Option B is incorrect. AES is a symmetric block cipher. Option D is incorrect. Diffie-Hellman is a key exchange method. Therefore, C, A hashing algorithm, is the correct answer.
Play from 26:50 Question 25. A trusted third party keeps copies of encryption keys so data can be recovered if a key is lost. What is this? Here are the options. Option A. Tokenization. Option B. Key stretching. Option C. Key escrow. Option D. Certificate pinning. Pause the video now if you want time to think about the answer.
The correct answer is C. Key escrow. Key escrow stores keys with a trusted party for recovery or lawful access. Now, why are the other options incorrect? Option A is incorrect. Tokenization replaces data with tokens. Option B is incorrect. Key stretching strengthens passwords. Option D is incorrect. Certificate pinning locks an app to a known certificate. Therefore, C, Key escrow, is the correct answer.
Play from 27:56 Question 26. Which certificate sits at the top of a chain of trust and is pre-installed in browsers and operating systems? Here are the options. Option A. The root certificate. Option B. A wildcard certificate. Option C. The leaf certificate. Option D. The intermediate certificate. Pause the video now if you want time to think about the answer.
The correct answer is A. The root certificate. The root CA certificate is the anchor that the rest of the chain is checked against. Now, why are the other options incorrect? Option B is incorrect. Wildcard describes name coverage. Option C is incorrect. The leaf is the server's own certificate at the bottom. Option D is incorrect. An intermediate is signed by the root. Therefore, A, The root certificate, is the correct answer.
Play from 29:04 Question 27. Which method lets two parties agree on a shared secret key over an untrusted network without ever sending the key itself? Here are the options. Option A. Diffie-Hellman. Option B. AES. Option C. SHA-256. Option D. MD5. Pause the video now if you want time to think about the answer.
The correct answer is A. Diffie-Hellman. Diffie-Hellman key exchange lets both sides calculate the same secret from values exchanged in public. Now, why are the other options incorrect? Option B is incorrect. AES encrypts data but needs a key already shared. Option C is incorrect. SHA-256 is a hash. Option D is incorrect. MD5 is an old hash. Therefore, A, Diffie-Hellman, is the correct answer.
Play from 30:16 Question 28. A payment system replaces each card number with a random value that only a secure vault can map back. What is this? Here are the options. Option A. Data masking. Option B. Hashing. Option C. Salting. Option D. Tokenization. Pause the video now if you want time to think about the answer.
The correct answer is D. Tokenization. Tokenization swaps sensitive data for a meaningless token, and only the vault can map it back. Now, why are the other options incorrect? Option A is incorrect. Masking hides part of a value but keeps the original. Option B is incorrect. Hashing cannot be mapped back. Option C is incorrect. Salting is for password hashes. Therefore, D, Tokenization, is the correct answer.
Play from 31:21 Question 29. Which key does a sender use to create a digital signature? Here are the options. Option A. The sender's public key. Option B. The recipient's private key. Option C. The recipient's public key. Option D. The sender's private key. Pause the video now if you want time to think about the answer.
The correct answer is D. The sender's private key. A signature is made with the sender's private key, so only the sender could have produced it. Now, why are the other options incorrect? Option A is incorrect. The public key is used to verify a signature. Option B is incorrect. The sender never has the recipient's private key. Option C is incorrect. The recipient's public key is used for encryption, not signing. Therefore, D, The sender's private key, is the correct answer.
Play from 32:24 Question 30. How long is the output of SHA-256? Here are the options. Option A. 128 bits. Option B. 512 bits. Option C. 160 bits. Option D. 256 bits. Pause the video now if you want time to think about the answer.
The correct answer is D. 256 bits. SHA-256 always produces a 256-bit digest, whatever the input size. Now, why are the other options incorrect? Option A is incorrect. 128 bits is the MD5 output length. Option B is incorrect. 512 bits is the SHA-512 output length. Option C is incorrect. 160 bits is the SHA-1 output length. Therefore, D, 256 bits, is the correct answer.
Play from 33:34 Question 31. A database team wants to encrypt individual customer rows rather than the whole database. Which type of encryption is this? Here are the options. Option A. Volume encryption. Option B. Partition encryption. Option C. Full-disk encryption. Option D. Record-level encryption. Pause the video now if you want time to think about the answer.
The correct answer is D. Record-level encryption. Record-level encryption protects individual records inside a database. Now, why are the other options incorrect? Option A is incorrect. Volume encryption covers a whole volume. Option B is incorrect. Partition encryption covers a whole partition. Option C is incorrect. Full-disk encryption covers the whole drive. Therefore, D, Record-level encryption, is the correct answer.
Play from 34:43 Question 32. What is RSA? Here are the options. Option A. An asymmetric encryption algorithm. Option B. A steganography method. Option C. A symmetric block cipher. Option D. A hashing algorithm. Pause the video now if you want time to think about the answer.
The correct answer is A. An asymmetric encryption algorithm. RSA uses a public and private key pair, for encryption and signatures. Now, why are the other options incorrect? Option B is incorrect. Steganography hides data inside other files. Option C is incorrect. AES is a symmetric block cipher. Option D is incorrect. SHA-256 is a hashing algorithm. Therefore, A, An asymmetric encryption algorithm, is the correct answer.
Play from 35:52 Question 33. A support screen shows only the last four digits of a customer's card number. What technique is this? Here are the options. Option A. Data masking. Option B. Tokenization. Option C. Steganography. Option D. Key stretching. Pause the video now if you want time to think about the answer.
The correct answer is A. Data masking. Data masking hides part of a value from people who do not need to see all of it. Now, why are the other options incorrect? Option B is incorrect. Tokenization replaces the whole value with a token. Option C is incorrect. Steganography hides data inside files. Option D is incorrect. Key stretching strengthens passwords. Therefore, A, Data masking, is the correct answer.
Play from 36:58 Question 34. Which key does a recipient use to verify a sender's digital signature? Here are the options. Option A. A shared symmetric key. Option B. The sender's public key. Option C. The recipient's private key. Option D. The sender's private key. Pause the video now if you want time to think about the answer.
The correct answer is B. The sender's public key. Anyone can verify a signature with the sender's public key. Now, why are the other options incorrect? Option A is incorrect. Signatures use a key pair, not a shared key. Option C is incorrect. The recipient's private key is for decrypting messages sent to them. Option D is incorrect. The sender's private key is never shared. Therefore, B, The sender's public key, is the correct answer.
Play from 38:05 Question 35. Alice wants to send Bob a message that only Bob can read, using asymmetric encryption. Which key should she encrypt it with? Here are the options. Option A. Bob's private key. Option B. Bob's public key. Option C. Alice's private key. Option D. Alice's public key. Pause the video now if you want time to think about the answer.
The correct answer is B. Bob's public key. Anything encrypted with Bob's public key can only be decrypted with Bob's private key, which only he holds. Now, why are the other options incorrect? Option A is incorrect. Alice never has Bob's private key. Option C is incorrect. Encrypting with Alice's private key is signing, which anyone can reverse with her public key. Option D is incorrect. Only Alice could decrypt with her own private key, not Bob. Therefore, B, Bob's public key, is the correct answer.
Play from 39:17 Question 36. Which certificate secures every first-level subdomain of example.com, such as shop.example.com and mail.example.com? Here are the options. Option A. A root certificate. Option B. A wildcard certificate. Option C. A self-signed certificate. Option D. A code signing certificate. Pause the video now if you want time to think about the answer.
The correct answer is B. A wildcard certificate. A wildcard certificate for star dot example.com covers every subdomain at that level. Now, why are the other options incorrect? Option A is incorrect. A root certificate anchors a CA chain. Option C is incorrect. A self-signed certificate is not trusted by browsers by default. Option D is incorrect. A code signing certificate signs software. Therefore, B, A wildcard certificate, is the correct answer.
Play from 40:29 Question 37. In PKI, which key must never be shared with anyone? Here are the options. Option A. The session ID. Option B. The CA's public certificate. Option C. The private key. Option D. The public key. Pause the video now if you want time to think about the answer.
The correct answer is C. The private key. If a private key is exposed, attackers can decrypt data and sign as its owner. Now, why are the other options incorrect? Option A is incorrect. A session ID is not a PKI key. Option B is incorrect. CA certificates are public. Option D is incorrect. The public key is meant to be shared. Therefore, C, The private key, is the correct answer.
Play from 41:28 Question 38. Which list, published by a CA, names certificates that were cancelled before they expired? Here are the options. Option A. Certificate revocation list. Option B. Certificate signing request. Option C. Key escrow list. Option D. Root certificate store. Pause the video now if you want time to think about the answer.
The correct answer is A. Certificate revocation list. A CRL lists revoked certificates that should no longer be trusted. Now, why are the other options incorrect? Option B is incorrect. A CSR is a request for a new certificate. Option C is incorrect. Key escrow concerns stored keys. Option D is incorrect. A root store holds trusted root certificates. Therefore, A, Certificate revocation list, is the correct answer.
Play from 42:39 Question 39. An internal test server uses a certificate that it signed itself, and browsers show a warning. What type of certificate is it? Here are the options. Option A. Root CA issued. Option B. Self-signed. Option C. Extended validation. Option D. Wildcard. Pause the video now if you want time to think about the answer.
The correct answer is B. Self-signed. A self-signed certificate is not vouched for by a trusted CA, so browsers do not trust it by default. Now, why are the other options incorrect? Option A is incorrect. A certificate issued by a trusted CA would not warn. Option C is incorrect. Extended validation certificates come from public CAs. Option D is incorrect. Wildcard describes name coverage, not who signed it. Therefore, B, Self-signed, is the correct answer.
Play from 43:49 Question 40. Which combines a hash function with a shared secret key, so the receiver can check a message is unaltered and came from a key holder? Here are the options. Option A. Steganography. Option B. Tokenization. Option C. Salting. Option D. HMAC. Pause the video now if you want time to think about the answer.
The correct answer is D. HMAC. A hash-based message authentication code proves both integrity and that the sender knew the key. Now, why are the other options incorrect? Option A is incorrect. Steganography hides data. Option B is incorrect. Tokenization replaces sensitive values. Option C is incorrect. Salting strengthens stored password hashes. Therefore, D, HMAC, is the correct answer.
Play from 44:58 Question 41. Which protocol version should be disabled because it is obsolete and insecure? Here are the options. Option A. SSL 3.0. Option B. TLS 1.3. Option C. AES-256. Option D. TLS 1.2. Pause the video now if you want time to think about the answer.
The correct answer is A. SSL 3.0. SSL 3.0 has known weaknesses and should be turned off in favour of modern TLS. Now, why are the other options incorrect? Option B is incorrect. TLS 1.3 is the current version. Option C is incorrect. AES-256 is a strong cipher, not a protocol version. Option D is incorrect. TLS 1.2 is still acceptable when well configured. Therefore, A, SSL 3.0, is the correct answer.
Play from 46:09 Question 42. What does an administrator send to a CA to request a new certificate? Here are the options. Option A. The server's private key. Option B. An OCSP response. Option C. A certificate revocation list. Option D. A certificate signing request. Pause the video now if you want time to think about the answer.
The correct answer is D. A certificate signing request. A CSR contains the public key and identity details; the private key stays on the server. Now, why are the other options incorrect? Option A is incorrect. The private key must never leave the server. Option B is incorrect. An OCSP response is a status answer. Option C is incorrect. A CRL lists revoked certificates. Therefore, D, A certificate signing request, is the correct answer.
Play from 47:17 Question 43. A web server attaches a recent, signed certificate status response during the TLS handshake, so clients don't have to ask the CA. What is this? Here are the options. Option A. A certificate revocation list. Option B. OCSP stapling. Option C. Key escrow. Option D. Certificate pinning. Pause the video now if you want time to think about the answer.
The correct answer is B. OCSP stapling. OCSP stapling saves clients a lookup and protects their privacy. Now, why are the other options incorrect? Option A is incorrect. A CRL is a downloaded list of revoked certificates. Option C is incorrect. Key escrow stores key copies. Option D is incorrect. Pinning locks an app to a known certificate. Therefore, B, OCSP stapling, is the correct answer.
Play from 48:28 Question 44. Which feature means that stealing a server's long-term private key does not expose recorded past sessions? Here are the options. Option A. Key escrow. Option B. Perfect forward secrecy. Option C. OCSP stapling. Option D. Key stretching. Pause the video now if you want time to think about the answer.
The correct answer is B. Perfect forward secrecy. Perfect forward secrecy uses a new ephemeral key for each session, so old sessions stay safe. Now, why are the other options incorrect? Option A is incorrect. Key escrow stores copies of keys with a third party. Option C is incorrect. OCSP stapling speeds up certificate status checks. Option D is incorrect. Key stretching strengthens weak passwords. Therefore, B, Perfect forward secrecy, is the correct answer.
Play from 49:37 Question 45. Which protected area inside a processor keeps sensitive data and keys isolated, even if the operating system is compromised? Here are the options. Option A. A key escrow agent. Option B. A certificate authority. Option C. A secure enclave. Option D. A hardware security module. Pause the video now if you want time to think about the answer.
The correct answer is C. A secure enclave. A secure enclave is an isolated part of the processor that the main OS cannot read. Now, why are the other options incorrect? Option A is incorrect. A key escrow agent holds key copies. Option B is incorrect. A CA issues certificates. Option D is incorrect. An HSM is a separate device. Therefore, C, A secure enclave, is the correct answer.
Play from 50:46 Question 46. A developer signs their software so users can confirm who published it and that it was not altered. Which certificate do they need? Here are the options. Option A. A wildcard certificate. Option B. A code signing certificate. Option C. A self-signed web certificate. Option D. An email certificate. Pause the video now if you want time to think about the answer.
The correct answer is B. A code signing certificate. A code signing certificate proves the publisher and the integrity of software. Now, why are the other options incorrect? Option A is incorrect. A wildcard secures web subdomains. Option C is incorrect. A self-signed web certificate is untrusted and meant for web servers. Option D is incorrect. An email certificate protects email. Therefore, B, A code signing certificate, is the correct answer.
Play from 51:55 Question 47. Which type of encryption uses the same key to encrypt and decrypt? Here are the options. Option A. Symmetric encryption. Option B. Digital signing. Option C. Asymmetric encryption. Option D. Hashing. Pause the video now if you want time to think about the answer.
The correct answer is A. Symmetric encryption. Symmetric encryption shares one secret key between both sides. Now, why are the other options incorrect? Option B is incorrect. Digital signing uses a private key to sign and a public key to verify. Option C is incorrect. Asymmetric encryption uses a public and private key pair. Option D is incorrect. Hashing is one-way and uses no decryption key. Therefore, A, Symmetric encryption, is the correct answer.
Play from 52:59 Question 48. Which entity issues and digitally signs certificates in a PKI? Here are the options. Option A. An OCSP responder. Option B. A certificate signing request. Option C. A certificate authority. Option D. A certificate revocation list. Pause the video now if you want time to think about the answer.
The correct answer is C. A certificate authority. The CA verifies identities and signs certificates with its private key. Now, why are the other options incorrect? Option A is incorrect. An OCSP responder answers status queries. Option B is incorrect. A CSR is the request sent to a CA. Option D is incorrect. A CRL lists revoked certificates. Therefore, C, A certificate authority, is the correct answer.
Play from 54:07 Question 49. A company wants one cloud service to create, rotate and control access to all of its encryption keys. What does it need? Here are the options. Option A. A Trusted Platform Module. Option B. A key management system. Option C. A certificate revocation list. Option D. Steganography. Pause the video now if you want time to think about the answer.
The correct answer is B. A key management system. A KMS centralises the key lifecycle: creation, rotation, access control and retirement. Now, why are the other options incorrect? Option A is incorrect. A TPM protects keys on one device. Option C is incorrect. A CRL lists revoked certificates. Option D is incorrect. Steganography hides data inside other files. Therefore, B, A key management system, is the correct answer.
Play from 55:18 Question 50. A company wants everything on its laptops protected if one is stolen. Which type of encryption fits best? Here are the options. Option A. Transport encryption. Option B. Full-disk encryption. Option C. File-level encryption. Option D. Record-level encryption. Pause the video now if you want time to think about the answer.
The correct answer is B. Full-disk encryption. Full-disk encryption protects the entire drive, including the operating system and temporary files. Now, why are the other options incorrect? Option A is incorrect. Transport encryption protects data in transit, not at rest. Option C is incorrect. File-level encryption only covers chosen files. Option D is incorrect. Record-level encryption is for database records. Therefore, B, Full-disk encryption, is the correct answer.
