Topic 04 Practice Test 3 covers Cryptography and PKI for CompTIA Security+ SY0-701 and maps to objective 1.4: Explain the importance of using appropriate cryptographic solutions. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
To recover encrypted data when business or legal policy requires access to a key, which security approach should be selected?
- Data masking
- Key escrow
- Asymmetric encryption
- Certificate authority
Correct Answer: B
Correct Answer
Answer B is correct because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. That is the function the question is testing. Certificate authority would instead be used for a trusted PKI entity that validates identity according to policy and digitally signs certificates.
Incorrect Answers
Answer A is incorrect because Data masking refers to alteration or obscuring of sensitive values so users or systems see realistic but protected representations. The concept is valid, but it does not match this stem. The required function is controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, which maps to Key escrow.
Answer C is incorrect because Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The concept is valid, but it does not match this stem. The required function is controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, which maps to Key escrow.
Answer D is incorrect because Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates. The concept is valid, but it does not match this stem. The required function is controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, which maps to Key escrow.
Question 2
Which term describes encryption that protects an entire storage device so data remains unreadable without authorized unlocking?
- Certificate authority
- Asymmetric encryption
- Online Certificate Status Protocol (OCSP)
- Full-disk encryption
Correct Answer: D
Correct Answer
Answer D is correct because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking. This is the precise fit for the scenario. Asymmetric encryption serves the different purpose of cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.
Incorrect Answers
Answer A is incorrect because Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates. This could be appropriate elsewhere, but the required function is encryption that protects an entire storage device so data remains unreadable without authorized unlocking; that makes Full-disk encryption the precise choice.
Answer B is incorrect because Asymmetric encryption refers to cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The scenario instead requires encryption that protects an entire storage device so data remains unreadable without authorized unlocking, which is why Full-disk encryption is the better answer; this option serves the different function defined above.
Answer C is incorrect because Online Certificate Status Protocol (OCSP) refers to a protocol used to query the current revocation status of a specific certificate. That concept can be valid in another scenario, but this question is testing encryption that protects an entire storage device so data remains unreadable without authorized unlocking; Full-disk encryption therefore fits the requirement more directly.
Question 3
A security engineer is working through a cryptographic architecture and PKI design review. The immediate requirement is concealment of information inside another apparently ordinary medium. Which choice is the best fit?
- Asymmetric encryption
- Salting
- Digital signature
- Steganography
Correct Answer: D
Correct Answer
Answer D is correct because Steganography means the concealment of information inside another apparently ordinary medium. This is the precise fit for the scenario. Asymmetric encryption serves the different purpose of cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.
Incorrect Answers
Answer A is incorrect because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. That concept can be valid in another scenario, but this question is testing the concealment of information inside another apparently ordinary medium; Steganography therefore fits the requirement more directly.
Answer B is incorrect because Salting means adding unique random data to a password before hashing it. The concept is valid, but it does not match this stem. The required function is the concealment of information inside another apparently ordinary medium, which maps to Steganography.
Answer C is incorrect because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key. The concept is valid, but it does not match this stem. The required function is the concealment of information inside another apparently ordinary medium, which maps to Steganography.
Question 4
During a cryptographic architecture and PKI design review, the team needs encryption applied to communications while data moves between endpoints. Which option best meets this requirement?
- Transport encryption
- Hardware security module (HSM)
- Symmetric encryption
- Public key infrastructure
Correct Answer: A
Correct Answer
Answer A is correct because Transport encryption means encryption applied to communications while data moves between endpoints. That is the function the question is testing. Hardware security module (HSM) would instead be used for a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys.
Incorrect Answers
Answer B is incorrect because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. This could be appropriate elsewhere, but the required function is encryption applied to communications while data moves between endpoints; that makes Transport encryption the precise choice.
Answer C is incorrect because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. This could be appropriate elsewhere, but the required function is encryption applied to communications while data moves between endpoints; that makes Transport encryption the precise choice.
Answer D is incorrect because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. This could be appropriate elsewhere, but the required function is encryption applied to communications while data moves between endpoints; that makes Transport encryption the precise choice.
Question 5
During a cryptographic architecture and PKI design review, three requirements must be addressed: (1) method that lets parties establish or agree on cryptographic key material over an untrusted network; (2) one-way transformation that produces a fixed-length digest and is commonly used to verify integrity; and (3) protocol used to query the current revocation status of a specific certificate. Which THREE choices best satisfy them? Choose THREE.
- Symmetric encryption
- Data masking
- Key exchange
- Full-disk encryption
- Hashing
- Online Certificate Status Protocol (OCSP)
Correct Answers: C, E, F
Correct Answers
Answer C is correct because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. The fixed-count item needs this function in the answer set. Data masking covers alteration or obscuring of sensitive values so users or systems see realistic but protected representations, a different requirement.
Answer E is correct because Hashing means a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity. It belongs in the fixed-count answer set because it covers one of the stated requirements. Symmetric encryption instead serves encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data and cannot replace this function.
Answer F is correct because Online Certificate Status Protocol (OCSP) means a protocol used to query the current revocation status of a specific certificate. It belongs in the fixed-count answer set because it covers one of the stated requirements. Data masking instead serves alteration or obscuring of sensitive values so users or systems see realistic but protected representations and cannot replace this function.
Incorrect Answers
Answer A is incorrect because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. The fixed-count answer set is Key exchange, Hashing, Online Certificate Status Protocol (OCSP); this option does not fill one of those named functions.
Answer B is incorrect because Data masking means alteration or obscuring of sensitive values so users or systems see realistic but protected representations. The question requires exactly 3 selections: Key exchange, Hashing, Online Certificate Status Protocol (OCSP). This option falls outside that required set.
Answer D is incorrect because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking. The required choices are Key exchange, Hashing, Online Certificate Status Protocol (OCSP). Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 6
To enable secure operations without sharing the private key, which security approach should be selected?
- Asymmetric encryption
- Certificate revocation list (CRL)
- Key exchange
- Symmetric encryption
Correct Answer: A
Correct Answer
Answer A is correct because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The deciding point is functional fit: this option covers the stated need, while Symmetric encryption addresses encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.
Incorrect Answers
Answer B is incorrect because Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration. This could be appropriate elsewhere, but the required function is cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange; that makes Asymmetric encryption the precise choice.
Answer C is incorrect because Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network. The concept is valid, but it does not match this stem. The required function is cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange, which maps to Asymmetric encryption.
Answer D is incorrect because Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. That concept can be valid in another scenario, but this question is testing cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange; Asymmetric encryption therefore fits the requirement more directly.
Question 7
To create a shared secret for later encrypted communication, which security approach should be selected?
- Key exchange
- Certificate revocation list (CRL)
- Full-disk encryption
- Root of trust
Correct Answer: A
Correct Answer
Answer A is correct because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. This is the precise fit for the scenario. Root of trust serves the different purpose of a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.
Incorrect Answers
Answer B is incorrect because Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration. The scenario instead requires a method that lets parties establish or agree on cryptographic key material over an untrusted network, which is why Key exchange is the better answer; this option serves the different function defined above.
Answer C is incorrect because Full-disk encryption refers to encryption that protects an entire storage device so data remains unreadable without authorized unlocking. This could be appropriate elsewhere, but the required function is a method that lets parties establish or agree on cryptographic key material over an untrusted network; that makes Key exchange the precise choice.
Answer D is incorrect because Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived. The scenario instead requires a method that lets parties establish or agree on cryptographic key material over an untrusted network, which is why Key exchange is the better answer; this option serves the different function defined above.
Question 8
To detect changes to data without needing to decrypt or recover the original input, which security approach should be selected?
- Key exchange
- Digital signature
- Symmetric encryption
- Hashing
Correct Answer: D
Correct Answer
Answer D is correct because Hashing means a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity. The requirement maps directly to this function, whereas Key exchange is aimed at a method that lets parties establish or agree on cryptographic key material over an untrusted network.
Incorrect Answers
Answer A is incorrect because Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network. The key mismatch is functional: Hashing addresses a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity, the need stated by the question.
Answer B is incorrect because Digital signature refers to a cryptographic value created with a private key and verified with the corresponding public key. The key mismatch is functional: Hashing addresses a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity, the need stated by the question.
Answer C is incorrect because Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. The concept is valid, but it does not match this stem. The required function is a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity, which maps to Hashing.
Question 9
An architect working on a cryptographic architecture and PKI design review needs one capability that provides people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates and another that provides hardware-backed security component that can protect keys and attest to platform state. Which TWO selections are the best match? Choose TWO.
- Wildcard certificate
- Secure enclave
- Trusted Platform Module (TPM)
- Public key infrastructure
- Digital signature
Correct Answers: C, D
Correct Answers
Answer C is correct because Trusted Platform Module (TPM) means a hardware-backed security component that can protect keys and attest to platform state. The fixed-count item needs this function in the answer set. Secure enclave covers an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment, a different requirement.
Answer D is correct because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. One required function is exactly what this option provides. Digital signature may be useful elsewhere, but it is used for a cryptographic value created with a private key and verified with the corresponding public key.
Incorrect Answers
Answer A is incorrect because Wildcard certificate means a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. The required choices are Public key infrastructure, Trusted Platform Module (TPM). Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because Secure enclave means an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. The question requires exactly 2 selections: Public key infrastructure, Trusted Platform Module (TPM). This option falls outside that required set.
Answer E is incorrect because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key. The required choices are Public key infrastructure, Trusted Platform Module (TPM). Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 10
Which term describes encryption applied to communications while data moves between endpoints?
- Root of trust
- Transport encryption
- Salting
- Secure enclave
Correct Answer: B
Correct Answer
Answer B is correct because Transport encryption means encryption applied to communications while data moves between endpoints. The deciding point is functional fit: this option covers the stated need, while Root of trust addresses a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.
Incorrect Answers
Answer A is incorrect because Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived. The question is not asking for this function. It is testing encryption applied to communications while data moves between endpoints, so Transport encryption is the stronger fit.
Answer C is incorrect because Salting refers to adding unique random data to a password before hashing it. The scenario instead requires encryption applied to communications while data moves between endpoints, which is why Transport encryption is the better answer; this option serves the different function defined above.
Answer D is incorrect because Secure enclave refers to an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. The question is not asking for this function. It is testing encryption applied to communications while data moves between endpoints, so Transport encryption is the stronger fit.
Question 11
To provide integrity, origin authentication, and strong evidence of authorship, which security approach should be selected?
- Digital signature
- Key management system
- Public key
- Public key infrastructure
Correct Answer: A
Correct Answer
Answer A is correct because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key. The requirement maps directly to this function, whereas Public key infrastructure is aimed at the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.
Incorrect Answers
Answer B is incorrect because Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. This could be appropriate elsewhere, but the required function is a cryptographic value created with a private key and verified with the corresponding public key; that makes Digital signature the precise choice.
Answer C is incorrect because Public key refers to the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. The scenario instead requires a cryptographic value created with a private key and verified with the corresponding public key, which is why Digital signature is the better answer; this option serves the different function defined above.
Answer D is incorrect because Public key infrastructure refers to the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. The concept is valid, but it does not match this stem. The required function is a cryptographic value created with a private key and verified with the corresponding public key, which maps to Digital signature.
Question 12
To establish the starting point for validating a trust chain, which security approach should be selected?
- Key exchange
- Transport encryption
- Root of trust
- Key stretching
Correct Answer: C
Correct Answer
Answer C is correct because Root of trust means a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived. This matches the requirement as written. Transport encryption can be valid in another context, but it is used for encryption applied to communications while data moves between endpoints.
Incorrect Answers
Answer A is incorrect because Key exchange refers to a method that lets parties establish or agree on cryptographic key material over an untrusted network. The concept is valid, but it does not match this stem. The required function is a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived, which maps to Root of trust.
Answer B is incorrect because Transport encryption refers to encryption applied to communications while data moves between endpoints. The scenario instead requires a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived, which is why Root of trust is the better answer; this option serves the different function defined above.
Answer D is incorrect because Key stretching refers to a technique that deliberately increases the computational cost of deriving a key from a password. The key mismatch is functional: Root of trust addresses a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived, the need stated by the question.
Question 13
Two requirements remain open in a cryptographic architecture and PKI design review: encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data; dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. Which TWO options close those specific gaps? Choose TWO.
- Wildcard certificate
- Symmetric encryption
- Hardware security module (HSM)
- Private key
- Key escrow
Correct Answers: B, C
Correct Answers
Answer B is correct because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. This option satisfies a specific requirement in the stem; Private key serves the secret half of an asymmetric key pair that must remain controlled by its owner and therefore is not interchangeable with it.
Answer C is correct because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. One required function is exactly what this option provides. Key escrow may be useful elsewhere, but it is used for controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances.
Incorrect Answers
Answer A is incorrect because Wildcard certificate means a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. The question requires exactly 2 selections: Symmetric encryption, Hardware security module (HSM). This option falls outside that required set.
Answer D is incorrect because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. The fixed-count answer set is Symmetric encryption, Hardware security module (HSM); this option does not fill one of those named functions.
Answer E is incorrect because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. Every answer slot must map to a stated requirement. The correct set is Symmetric encryption, Hardware security module (HSM), so this option cannot replace one of those selections.
Question 14
A review during a cryptographic architecture and PKI design review identifies two gaps. One requires isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. The other requires certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. Which TWO options should be included in the remediation plan? Choose TWO.
- Trusted Platform Module (TPM)
- Key stretching
- Asymmetric encryption
- Wildcard certificate
- Secure enclave
Correct Answers: D, E
Correct Answers
Answer D is correct because Wildcard certificate means a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. One required function is exactly what this option provides. Asymmetric encryption may be useful elsewhere, but it is used for cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.
Answer E is correct because Secure enclave means an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. The fixed-count item needs this function in the answer set. Key stretching covers a technique that deliberately increases the computational cost of deriving a key from a password, a different requirement.
Incorrect Answers
Answer A is incorrect because Trusted Platform Module (TPM) means a hardware-backed security component that can protect keys and attest to platform state. The scenario calls for Wildcard certificate, Secure enclave. Selecting this option would leave one of those required functions uncovered.
Answer B is incorrect because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. The scenario calls for Wildcard certificate, Secure enclave. Selecting this option would leave one of those required functions uncovered.
Answer C is incorrect because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The required choices are Wildcard certificate, Secure enclave. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 15
Which term describes adding unique random data to a password before hashing it?
- Key stretching
- Symmetric encryption
- Salting
- Wildcard certificate
Correct Answer: C
Correct Answer
Answer C is correct because Salting means adding unique random data to a password before hashing it. The requirement maps directly to this function, whereas Symmetric encryption is aimed at encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data.
Incorrect Answers
Answer A is incorrect because Key stretching refers to a technique that deliberately increases the computational cost of deriving a key from a password. The question is not asking for this function. It is testing adding unique random data to a password before hashing it, so Salting is the stronger fit.
Answer B is incorrect because Symmetric encryption refers to encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. The scenario instead requires adding unique random data to a password before hashing it, which is why Salting is the better answer; this option serves the different function defined above.
Answer D is incorrect because Wildcard certificate refers to a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. The key mismatch is functional: Salting addresses adding unique random data to a password before hashing it, the need stated by the question.
Question 16
To bind cryptographic material to a device and strengthen boot or credential security, which security approach should be selected?
- Key stretching
- Key management system
- Trusted Platform Module (TPM)
- Hashing
Correct Answer: C
Correct Answer
Answer C is correct because Trusted Platform Module (TPM) means a hardware-backed security component that can protect keys and attest to platform state. The requirement maps directly to this function, whereas Key stretching is aimed at a technique that deliberately increases the computational cost of deriving a key from a password.
Incorrect Answers
Answer A is incorrect because Key stretching refers to a technique that deliberately increases the computational cost of deriving a key from a password. The key mismatch is functional: Trusted Platform Module (TPM) addresses a hardware-backed security component that can protect keys and attest to platform state, the need stated by the question.
Answer B is incorrect because Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. The question is not asking for this function. It is testing a hardware-backed security component that can protect keys and attest to platform state, so Trusted Platform Module (TPM) is the stronger fit.
Answer D is incorrect because Hashing refers to a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity. This could be appropriate elsewhere, but the required function is a hardware-backed security component that can protect keys and attest to platform state; that makes Trusted Platform Module (TPM) the precise choice.
Question 17
What is the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates?
- Tokenization
- Public key infrastructure
- Certificate authority
- Certificate revocation list (CRL)
Correct Answer: B
Correct Answer
Answer B is correct because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. The deciding point is functional fit: this option covers the stated need, while Certificate authority addresses a trusted PKI entity that validates identity according to policy and digitally signs certificates.
Incorrect Answers
Answer A is incorrect because Tokenization refers to replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. That concept can be valid in another scenario, but this question is testing the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates; Public key infrastructure therefore fits the requirement more directly.
Answer C is incorrect because Certificate authority refers to a trusted PKI entity that validates identity according to policy and digitally signs certificates. The key mismatch is functional: Public key infrastructure addresses the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates, the need stated by the question.
Answer D is incorrect because Certificate revocation list (CRL) refers to a published list of certificates that a certificate authority has revoked before their scheduled expiration. This could be appropriate elsewhere, but the required function is the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates; that makes Public key infrastructure the precise choice.
Question 18
An architect working on a cryptographic architecture and PKI design review needs one capability that provides replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system and another that provides protocol used to query the current revocation status of a specific certificate. Which TWO selections are the best match? Choose TWO.
- Trusted Platform Module (TPM)
- Full-disk encryption
- Secure enclave
- Online Certificate Status Protocol (OCSP)
- Tokenization
Correct Answers: D, E
Correct Answers
Answer D is correct because Online Certificate Status Protocol (OCSP) means a protocol used to query the current revocation status of a specific certificate. It belongs in the fixed-count answer set because it covers one of the stated requirements. Trusted Platform Module (TPM) instead serves a hardware-backed security component that can protect keys and attest to platform state and cannot replace this function.
Answer E is correct because Tokenization means replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. The fixed-count item needs this function in the answer set. Full-disk encryption covers encryption that protects an entire storage device so data remains unreadable without authorized unlocking, a different requirement.
Incorrect Answers
Answer A is incorrect because Trusted Platform Module (TPM) means a hardware-backed security component that can protect keys and attest to platform state. Every answer slot must map to a stated requirement. The correct set is Online Certificate Status Protocol (OCSP), Tokenization, so this option cannot replace one of those selections.
Answer B is incorrect because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking. The fixed-count answer set is Online Certificate Status Protocol (OCSP), Tokenization; this option does not fill one of those named functions.
Answer C is incorrect because Secure enclave means an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. The required choices are Online Certificate Status Protocol (OCSP), Tokenization. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 19
What is the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder?
- Key management system
- Trusted Platform Module (TPM)
- Root of trust
- Public key
Correct Answer: D
Correct Answer
Answer D is correct because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. This matches the requirement as written. Key management system can be valid in another context, but it is used for a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.
Incorrect Answers
Answer A is incorrect because Key management system refers to a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. The concept is valid, but it does not match this stem. The required function is the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder, which maps to Public key.
Answer B is incorrect because Trusted Platform Module (TPM) refers to a hardware-backed security component that can protect keys and attest to platform state. The question is not asking for this function. It is testing the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder, so Public key is the stronger fit.
Answer C is incorrect because Root of trust refers to a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived. That concept can be valid in another scenario, but this question is testing the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder; Public key therefore fits the requirement more directly.
Question 20
An architect working on a cryptographic architecture and PKI design review needs one capability that provides encryption applied to communications while data moves between endpoints and another that provides certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. Which TWO selections are the best match? Choose TWO.
- Transport encryption
- Root of trust
- Wildcard certificate
- Hashing
- Steganography
Correct Answers: A, C
Correct Answers
Answer A is correct because Transport encryption means encryption applied to communications while data moves between endpoints. The fixed-count item needs this function in the answer set. Hashing covers a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity, a different requirement.
Answer C is correct because Wildcard certificate means a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. This selection maps directly to one of the named needs. Hashing addresses a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity, so it does not satisfy the same slot.
Incorrect Answers
Answer B is incorrect because Root of trust means a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived. The required choices are Wildcard certificate, Transport encryption. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer D is incorrect because Hashing means a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity. The required choices are Wildcard certificate, Transport encryption. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Steganography means the concealment of information inside another apparently ordinary medium. The scenario calls for Wildcard certificate, Transport encryption. Selecting this option would leave one of those required functions uncovered. For example, Wildcard certificate is required for a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com.
