Topic 04 Practice Test 2 covers Cryptography and PKI for CompTIA Security+ SY0-701 and maps to objective 1.4: Explain the importance of using appropriate cryptographic solutions. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
Two requirements remain open in a cryptographic architecture and PKI design review: encryption that protects an entire storage device so data remains unreadable without authorized unlocking; shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. Which TWO options close those specific gaps? Choose TWO.
- Key exchange
- Public key
- Full-disk encryption
- Key stretching
- Salting
Correct Answers: B, C
Correct Answers
Answer B is correct because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. This selection maps directly to one of the named needs. Key exchange addresses a method that lets parties establish or agree on cryptographic key material over an untrusted network, so it does not satisfy the same slot.
Answer C is correct because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking. One required function is exactly what this option provides. Salting may be useful elsewhere, but it is used for adding unique random data to a password before hashing it.
Incorrect Answers
Answer A is incorrect because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. Every answer slot must map to a stated requirement. The correct set is Public key, Full-disk encryption, so this option cannot replace one of those selections.
Answer D is incorrect because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. The scenario calls for Public key, Full-disk encryption. Selecting this option would leave one of those required functions uncovered.
Answer E is incorrect because Salting means adding unique random data to a password before hashing it. The question requires exactly 2 selections: Public key, Full-disk encryption. This option falls outside that required set. For example, Public key is required for the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder.
Question 2
A review during a cryptographic architecture and PKI design review identifies two gaps. One requires encryption applied to communications while data moves between endpoints. The other requires dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. Which TWO options should be included in the remediation plan? Choose TWO.
- Private key
- Certificate authority
- Transport encryption
- Full-disk encryption
- Hardware security module (HSM)
Correct Answers: C, E
Correct Answers
Answer C is correct because Transport encryption means encryption applied to communications while data moves between endpoints. This option satisfies a specific requirement in the stem; Private key serves the secret half of an asymmetric key pair that must remain controlled by its owner and therefore is not interchangeable with it.
Answer E is correct because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. This selection maps directly to one of the named needs. Certificate authority addresses a trusted PKI entity that validates identity according to policy and digitally signs certificates, so it does not satisfy the same slot.
Incorrect Answers
Answer A is incorrect because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. The question requires exactly 2 selections: Transport encryption, Hardware security module (HSM). This option falls outside that required set.
Answer B is incorrect because Certificate authority means a trusted PKI entity that validates identity according to policy and digitally signs certificates. The scenario calls for Transport encryption, Hardware security module (HSM). Selecting this option would leave one of those required functions uncovered.
Answer D is incorrect because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking. The required choices are Transport encryption, Hardware security module (HSM). Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 3
To manage many encryption keys consistently and audibly, which security approach should be selected?
- Root of trust
- Steganography
- Key management system
- Certificate revocation list (CRL)
Correct Answer: C
Correct Answer
Answer C is correct because Key management system means a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. The requirement maps directly to this function, whereas Steganography is aimed at the concealment of information inside another apparently ordinary medium.
Incorrect Answers
Answer A is incorrect because Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived. The question is not asking for this function. It is testing a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation, so Key management system is the stronger fit.
Answer B is incorrect because Steganography refers to the concealment of information inside another apparently ordinary medium. The question is not asking for this function. It is testing a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation, so Key management system is the stronger fit.
Answer D is incorrect because Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration. That concept can be valid in another scenario, but this question is testing a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation; Key management system therefore fits the requirement more directly.
Question 4
To hide the existence of a message rather than simply encrypting its content, which security approach should be selected?
- Tokenization
- Salting
- Certificate authority
- Steganography
Correct Answer: D
Correct Answer
Answer D is correct because Steganography means the concealment of information inside another apparently ordinary medium. That is the function the question is testing. Tokenization would instead be used for replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system.
Incorrect Answers
Answer A is incorrect because Tokenization refers to replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. The scenario instead requires the concealment of information inside another apparently ordinary medium, which is why Steganography is the better answer; this option serves the different function defined above.
Answer B is incorrect because Salting refers to adding unique random data to a password before hashing it. The key mismatch is functional: Steganography addresses the concealment of information inside another apparently ordinary medium, the need stated by the question.
Answer C is incorrect because Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates. This could be appropriate elsewhere, but the required function is the concealment of information inside another apparently ordinary medium; that makes Steganography the precise choice.
Question 5
Which isolated protected execution area is used to keep sensitive code or cryptographic material separate from the normal operating environment?
- Certificate authority
- Key exchange
- Tokenization
- Secure enclave
Correct Answer: D
Correct Answer
Answer D is correct because Secure enclave means an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. The deciding point is functional fit: this option covers the stated need, while Tokenization addresses replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system.
Incorrect Answers
Answer A is incorrect because Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates. The key mismatch is functional: Secure enclave addresses an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment, the need stated by the question.
Answer B is incorrect because Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network. The question is not asking for this function. It is testing an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment, so Secure enclave is the stronger fit.
Answer C is incorrect because Tokenization refers to replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. That concept can be valid in another scenario, but this question is testing an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment; Secure enclave therefore fits the requirement more directly.
Question 6
The control set for a cryptographic architecture and PKI design review must address both one-way transformation that produces a fixed-length digest and is commonly used to verify integrity and protocol used to query the current revocation status of a specific certificate. Which TWO choices map directly to those needs? Choose TWO.
- Key management system
- Online Certificate Status Protocol (OCSP)
- Secure enclave
- Transport encryption
- Hashing
Correct Answers: B, E
Correct Answers
Answer B is correct because Online Certificate Status Protocol (OCSP) means a protocol used to query the current revocation status of a specific certificate. One required function is exactly what this option provides. Transport encryption may be useful elsewhere, but it is used for encryption applied to communications while data moves between endpoints.
Answer E is correct because Hashing means a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity. It belongs in the fixed-count answer set because it covers one of the stated requirements. Secure enclave instead serves an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment and cannot replace this function.
Incorrect Answers
Answer A is incorrect because Key management system means a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. The required choices are Hashing, Online Certificate Status Protocol (OCSP). Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer C is incorrect because Secure enclave means an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. The question requires exactly 2 selections: Hashing, Online Certificate Status Protocol (OCSP). This option falls outside that required set.
Answer D is incorrect because Transport encryption means encryption applied to communications while data moves between endpoints. Every answer slot must map to a stated requirement. The correct set is Hashing, Online Certificate Status Protocol (OCSP), so this option cannot replace one of those selections.
Question 7
To decrypt protected material or create digital signatures, which security approach should be selected?
- Private key
- Public key infrastructure
- Wildcard certificate
- Symmetric encryption
Correct Answer: A
Correct Answer
Answer A is correct because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. The requirement maps directly to this function, whereas Public key infrastructure is aimed at the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.
Incorrect Answers
Answer B is incorrect because Public key infrastructure refers to the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. The scenario instead requires the secret half of an asymmetric key pair that must remain controlled by its owner, which is why Private key is the better answer; this option serves the different function defined above.
Answer C is incorrect because Wildcard certificate refers to a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. The scenario instead requires the secret half of an asymmetric key pair that must remain controlled by its owner, which is why Private key is the better answer; this option serves the different function defined above.
Answer D is incorrect because Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. The question is not asking for this function. It is testing the secret half of an asymmetric key pair that must remain controlled by its owner, so Private key is the stronger fit.
Question 8
To protect confidentiality and integrity of data in transit, which security approach should be selected?
- Transport encryption
- Online Certificate Status Protocol (OCSP)
- Trusted Platform Module (TPM)
- Public key
Correct Answer: A
Correct Answer
Answer A is correct because Transport encryption means encryption applied to communications while data moves between endpoints. This is the precise fit for the scenario. Public key serves the different purpose of the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder.
Incorrect Answers
Answer B is incorrect because Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate. The key mismatch is functional: Transport encryption addresses encryption applied to communications while data moves between endpoints, the need stated by the question.
Answer C is incorrect because Trusted Platform Module (TPM) refers to a hardware-backed security component that can protect keys and attest to platform state. The question is not asking for this function. It is testing encryption applied to communications while data moves between endpoints, so Transport encryption is the stronger fit.
Answer D is incorrect because Public key refers to the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. The concept is valid, but it does not match this stem. The required function is encryption applied to communications while data moves between endpoints, which maps to Transport encryption.
Question 9
Which trusted PKI entity validates identity according to policy and digitally signs certificates?
- Secure enclave
- Data masking
- Salting
- Certificate authority
Correct Answer: D
Correct Answer
Answer D is correct because Certificate authority means a trusted PKI entity that validates identity according to policy and digitally signs certificates. The requirement maps directly to this function, whereas Salting is aimed at adding unique random data to a password before hashing it.
Incorrect Answers
Answer A is incorrect because Secure enclave refers to an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. This could be appropriate elsewhere, but the required function is a trusted PKI entity that validates identity according to policy and digitally signs certificates; that makes Certificate authority the precise choice.
Answer B is incorrect because Data masking refers to alteration or obscuring of sensitive values so users or systems see realistic but protected representations. The scenario instead requires a trusted PKI entity that validates identity according to policy and digitally signs certificates, which is why Certificate authority is the better answer; this option serves the different function defined above.
Answer C is incorrect because Salting refers to adding unique random data to a password before hashing it. The scenario instead requires a trusted PKI entity that validates identity according to policy and digitally signs certificates, which is why Certificate authority is the better answer; this option serves the different function defined above.
Question 10
To make password guessing more expensive for attackers, which security approach should be selected?
- Certificate revocation list (CRL)
- Asymmetric encryption
- Key stretching
- Trusted Platform Module (TPM)
Correct Answer: C
Correct Answer
Answer C is correct because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. The requirement maps directly to this function, whereas Trusted Platform Module (TPM) is aimed at a hardware-backed security component that can protect keys and attest to platform state.
Incorrect Answers
Answer A is incorrect because Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration. The concept is valid, but it does not match this stem. The required function is a technique that deliberately increases the computational cost of deriving a key from a password, which maps to Key stretching.
Answer B is incorrect because Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. This could be appropriate elsewhere, but the required function is a technique that deliberately increases the computational cost of deriving a key from a password; that makes Key stretching the precise choice.
Answer D is incorrect because Trusted Platform Module (TPM) refers to a hardware-backed security component that can protect keys and attest to platform state. That concept can be valid in another scenario, but this question is testing a technique that deliberately increases the computational cost of deriving a key from a password; Key stretching therefore fits the requirement more directly.
Question 11
Two requirements remain open in a cryptographic architecture and PKI design review: cryptographic value created with a private key and verified with the corresponding public key; people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. Which TWO options close those specific gaps? Choose TWO.
- Hardware security module (HSM)
- Salting
- Digital signature
- Key management system
- Public key infrastructure
Correct Answers: C, E
Correct Answers
Answer C is correct because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key. One required function is exactly what this option provides. Hardware security module (HSM) may be useful elsewhere, but it is used for a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys.
Answer E is correct because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. This option satisfies a specific requirement in the stem; Hardware security module (HSM) serves a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. The required choices are Public key infrastructure, Digital signature. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because Salting means adding unique random data to a password before hashing it. The question requires exactly 2 selections: Public key infrastructure, Digital signature. This option falls outside that required set. For example, Digital signature is required for a cryptographic value created with a private key and verified with the corresponding public key.
Answer D is incorrect because Key management system means a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. The fixed-count answer set is Public key infrastructure, Digital signature; this option does not fill one of those named functions.
Question 12
Which cryptographic value is created with a private key and verified with the corresponding public key?
- Digital signature
- Asymmetric encryption
- Key escrow
- Online Certificate Status Protocol (OCSP)
Correct Answer: A
Correct Answer
Answer A is correct because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key. The requirement maps directly to this function, whereas Online Certificate Status Protocol (OCSP) is aimed at a protocol used to query the current revocation status of a specific certificate.
Incorrect Answers
Answer B is incorrect because Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The scenario instead requires a cryptographic value created with a private key and verified with the corresponding public key, which is why Digital signature is the better answer; this option serves the different function defined above.
Answer C is incorrect because Key escrow refers to controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The key mismatch is functional: Digital signature addresses a cryptographic value created with a private key and verified with the corresponding public key, the need stated by the question.
Answer D is incorrect because Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate. The question is not asking for this function. It is testing a cryptographic value created with a private key and verified with the corresponding public key, so Digital signature is the stronger fit.
Question 13
To establish scalable trust for certificate-based authentication and encryption, which security approach should be selected?
- Key management system
- Public key infrastructure
- Hashing
- Secure enclave
Correct Answer: B
Correct Answer
Answer B is correct because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. This matches the requirement as written. Hashing can be valid in another context, but it is used for a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity.
Incorrect Answers
Answer A is incorrect because Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. The scenario instead requires the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates, which is why Public key infrastructure is the better answer; this option serves the different function defined above.
Answer C is incorrect because Hashing refers to a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity. The scenario instead requires the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates, which is why Public key infrastructure is the better answer; this option serves the different function defined above.
Answer D is incorrect because Secure enclave refers to an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. The key mismatch is functional: Public key infrastructure addresses the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates, the need stated by the question.
Question 14
To protect data efficiently when communicating parties can securely share one secret key, which security approach should be selected?
- Salting
- Certificate revocation list (CRL)
- Symmetric encryption
- Asymmetric encryption
Correct Answer: C
Correct Answer
Answer C is correct because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. This is the precise fit for the scenario. Certificate revocation list (CRL) serves the different purpose of a published list of certificates that a certificate authority has revoked before their scheduled expiration.
Incorrect Answers
Answer A is incorrect because Salting refers to adding unique random data to a password before hashing it. The concept is valid, but it does not match this stem. The required function is encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data, which maps to Symmetric encryption.
Answer B is incorrect because Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration. The question is not asking for this function. It is testing encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data, so Symmetric encryption is the stronger fit.
Answer D is incorrect because Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. That concept can be valid in another scenario, but this question is testing encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data; Symmetric encryption therefore fits the requirement more directly.
Question 15
Which term describes controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances?
- Symmetric encryption
- Key escrow
- Transport encryption
- Online Certificate Status Protocol (OCSP)
Correct Answer: B
Correct Answer
Answer B is correct because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. That makes it the best answer here; Symmetric encryption addresses encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. The question is not asking for this function. It is testing controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, so Key escrow is the stronger fit.
Answer C is incorrect because Transport encryption refers to encryption applied to communications while data moves between endpoints. The key mismatch is functional: Key escrow addresses controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, the need stated by the question.
Answer D is incorrect because Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate. The scenario instead requires controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, which is why Key escrow is the better answer; this option serves the different function defined above.
Question 16
During a cryptographic architecture and PKI design review, the team has two independent requirements: (1) encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data; and (2) method that lets parties establish or agree on cryptographic key material over an untrusted network. Which TWO choices best satisfy those requirements? Choose TWO.
- Key exchange
- Trusted Platform Module (TPM)
- Symmetric encryption
- Key stretching
- Salting
Correct Answers: A, C
Correct Answers
Answer A is correct because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. It belongs in the fixed-count answer set because it covers one of the stated requirements. Salting instead serves adding unique random data to a password before hashing it and cannot replace this function.
Answer C is correct because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. One required function is exactly what this option provides. Key stretching may be useful elsewhere, but it is used for a technique that deliberately increases the computational cost of deriving a key from a password.
Incorrect Answers
Answer B is incorrect because Trusted Platform Module (TPM) means a hardware-backed security component that can protect keys and attest to platform state. The required choices are Symmetric encryption, Key exchange. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer D is incorrect because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. The fixed-count answer set is Symmetric encryption, Key exchange; this option does not fill one of those named functions.
Answer E is incorrect because Salting means adding unique random data to a password before hashing it. The required choices are Symmetric encryption, Key exchange. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 17
Which term describes encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data?
- Certificate signing request (CSR)
- Symmetric encryption
- Digital signature
- Certificate revocation list (CRL)
Correct Answer: B
Correct Answer
Answer B is correct because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. That makes it the best answer here; Certificate signing request (CSR) addresses a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Certificate signing request (CSR) refers to a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance. The scenario instead requires encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data, which is why Symmetric encryption is the better answer; this option serves the different function defined above.
Answer C is incorrect because Digital signature refers to a cryptographic value created with a private key and verified with the corresponding public key. This could be appropriate elsewhere, but the required function is encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data; that makes Symmetric encryption the precise choice.
Answer D is incorrect because Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration. The question is not asking for this function. It is testing encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data, so Symmetric encryption is the stronger fit. This question specifically tests the requirement represented by Symmetric encryption.
Question 18
Which method lets parties establish or agree on cryptographic key material over an untrusted network?
- Public key infrastructure
- Root of trust
- Digital signature
- Key exchange
Correct Answer: D
Correct Answer
Answer D is correct because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. That makes it the best answer here; Digital signature addresses a cryptographic value created with a private key and verified with the corresponding public key, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Public key infrastructure refers to the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. The concept is valid, but it does not match this stem. The required function is a method that lets parties establish or agree on cryptographic key material over an untrusted network, which maps to Key exchange.
Answer B is incorrect because Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived. The concept is valid, but it does not match this stem. The required function is a method that lets parties establish or agree on cryptographic key material over an untrusted network, which maps to Key exchange.
Answer C is incorrect because Digital signature refers to a cryptographic value created with a private key and verified with the corresponding public key. That concept can be valid in another scenario, but this question is testing a method that lets parties establish or agree on cryptographic key material over an untrusted network; Key exchange therefore fits the requirement more directly.
Question 19
Reviewers working through a cryptographic architecture and PKI design review identify three separate needs: shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder; secret half of an asymmetric key pair that must remain controlled by its owner; concealment of information inside another apparently ordinary medium. Which THREE choices map to those needs? Choose THREE.
- Steganography
- Certificate authority
- Key escrow
- Key exchange
- Private key
- Public key
Correct Answers: A, E, F
Correct Answers
Answer A is correct because Steganography means the concealment of information inside another apparently ordinary medium. It belongs in the fixed-count answer set because it covers one of the stated requirements. Key exchange instead serves a method that lets parties establish or agree on cryptographic key material over an untrusted network and cannot replace this function.
Answer E is correct because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. The fixed-count item needs this function in the answer set. Key escrow covers controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, a different requirement.
Answer F is correct because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. This selection maps directly to one of the named needs. Key escrow addresses controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, so it does not satisfy the same slot.
Incorrect Answers
Answer B is incorrect because Certificate authority means a trusted PKI entity that validates identity according to policy and digitally signs certificates. The scenario calls for Public key, Private key, Steganography. Selecting this option would leave one of those required functions uncovered.
Answer C is incorrect because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The required choices are Public key, Private key, Steganography. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer D is incorrect because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. The question requires exactly 3 selections: Public key, Private key, Steganography. This option falls outside that required set.
Question 20
To make identical passwords produce different hashes and weaken precomputed cracking attacks, which security approach should be selected?
- Steganography
- Hardware security module (HSM)
- Salting
- Key management system
Correct Answer: C
Correct Answer
Answer C is correct because Salting means adding unique random data to a password before hashing it. That is the function the question is testing. Steganography would instead be used for the concealment of information inside another apparently ordinary medium.
Incorrect Answers
Answer A is incorrect because Steganography refers to the concealment of information inside another apparently ordinary medium. This could be appropriate elsewhere, but the required function is adding unique random data to a password before hashing it; that makes Salting the precise choice.
Answer B is incorrect because Hardware security module (HSM) refers to a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. The concept is valid, but it does not match this stem. The required function is adding unique random data to a password before hashing it, which maps to Salting.
Answer D is incorrect because Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. This could be appropriate elsewhere, but the required function is adding unique random data to a password before hashing it; that makes Salting the precise choice.
