Topic 04 Practice Test 4 covers Cryptography and PKI for CompTIA Security+ SY0-701 and maps to objective 1.4: Explain the importance of using appropriate cryptographic solutions. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
A review during a cryptographic architecture and PKI design review identifies two gaps. One requires controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The other requires centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. Which TWO options should be included in the remediation plan? Choose TWO.
- Key escrow
- Online Certificate Status Protocol (OCSP)
- Certificate authority
- Key management system
- Public key
Correct Answers: A, D
Correct Answers
Answer A is correct because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The fixed-count item needs this function in the answer set. Certificate authority covers a trusted PKI entity that validates identity according to policy and digitally signs certificates, a different requirement.
Answer D is correct because Key management system means a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. It belongs in the fixed-count answer set because it covers one of the stated requirements. Public key instead serves the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder and cannot replace this function.
Incorrect Answers
Answer B is incorrect because Online Certificate Status Protocol (OCSP) means a protocol used to query the current revocation status of a specific certificate. The scenario calls for Key management system, Key escrow. Selecting this option would leave one of those required functions uncovered.
Answer C is incorrect because Certificate authority means a trusted PKI entity that validates identity according to policy and digitally signs certificates. The question requires exactly 2 selections: Key management system, Key escrow. This option falls outside that required set.
Answer E is incorrect because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. The required choices are Key management system, Key escrow. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 2
A design decision in a cryptographic architecture and PKI design review must provide technique that deliberately increases the computational cost of deriving a key from a password. Which choice most directly satisfies that requirement?
- Digital signature
- Key stretching
- Private key
- Hardware security module (HSM)
Correct Answer: B
Correct Answer
Answer B is correct because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. This matches the requirement as written. Digital signature can be valid in another context, but it is used for a cryptographic value created with a private key and verified with the corresponding public key.
Incorrect Answers
Answer A is incorrect because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key. This could be appropriate elsewhere, but the required function is a technique that deliberately increases the computational cost of deriving a key from a password; that makes Key stretching the precise choice.
Answer C is incorrect because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. The key mismatch is functional: Key stretching addresses a technique that deliberately increases the computational cost of deriving a key from a password, the need stated by the question.
Answer D is incorrect because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. This could be appropriate elsewhere, but the required function is a technique that deliberately increases the computational cost of deriving a key from a password; that makes Key stretching the precise choice.
Question 3
A security engineer is working through a cryptographic architecture and PKI design review. The immediate requirement is people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. Which choice is the best fit?
- Key exchange
- Certificate authority
- Public key infrastructure
- Key stretching
Correct Answer: C
Correct Answer
Answer C is correct because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. The deciding point is functional fit: this option covers the stated need, while Key stretching addresses a technique that deliberately increases the computational cost of deriving a key from a password.
Incorrect Answers
Answer A is incorrect because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. That concept can be valid in another scenario, but this question is testing the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates; Public key infrastructure therefore fits the requirement more directly.
Answer B is incorrect because Certificate authority means a trusted PKI entity that validates identity according to policy and digitally signs certificates. The question is not asking for this function. It is testing the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates, so Public key infrastructure is the stronger fit.
Answer D is incorrect because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. The question is not asking for this function. It is testing the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates, so Public key infrastructure is the stronger fit.
Question 4
A design decision in a cryptographic architecture and PKI design review must provide encryption that protects an entire storage device so data remains unreadable without authorized unlocking. Which choice most directly satisfies that requirement?
- Full-disk encryption
- Wildcard certificate
- Public key infrastructure
- Data masking
Correct Answer: A
Correct Answer
Answer A is correct because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking. This matches the requirement as written. Data masking can be valid in another context, but it is used for alteration or obscuring of sensitive values so users or systems see realistic but protected representations.
Incorrect Answers
Answer B is incorrect because Wildcard certificate means a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. That concept can be valid in another scenario, but this question is testing encryption that protects an entire storage device so data remains unreadable without authorized unlocking; Full-disk encryption therefore fits the requirement more directly.
Answer C is incorrect because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. The key mismatch is functional: Full-disk encryption addresses encryption that protects an entire storage device so data remains unreadable without authorized unlocking, the need stated by the question.
Answer D is incorrect because Data masking means alteration or obscuring of sensitive values so users or systems see realistic but protected representations. The key mismatch is functional: Full-disk encryption addresses encryption that protects an entire storage device so data remains unreadable without authorized unlocking, the need stated by the question.
Question 5
A review during a cryptographic architecture and PKI design review identifies two gaps. One requires shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. The other requires published list of certificates that a certificate authority has revoked before their scheduled expiration. Which TWO options should be included in the remediation plan? Choose TWO.
- Public key
- Certificate revocation list (CRL)
- Hashing
- Private key
- Hardware security module (HSM)
Correct Answers: A, B
Correct Answers
Answer A is correct because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. This selection maps directly to one of the named needs. Hardware security module (HSM) addresses a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys, so it does not satisfy the same slot.
Answer B is correct because Certificate revocation list (CRL) means a published list of certificates that a certificate authority has revoked before their scheduled expiration. It belongs in the fixed-count answer set because it covers one of the stated requirements. Hardware security module (HSM) instead serves a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys and cannot replace this function.
Incorrect Answers
Answer C is incorrect because Hashing means a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity. The required choices are Certificate revocation list (CRL), Public key. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer D is incorrect because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. Every answer slot must map to a stated requirement. The correct set is Certificate revocation list (CRL), Public key, so this option cannot replace one of those selections.
Answer E is incorrect because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. The scenario calls for Certificate revocation list (CRL), Public key. Selecting this option would leave one of those required functions uncovered.
Question 6
Two requirements remain open in a cryptographic architecture and PKI design review: shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder; secret half of an asymmetric key pair that must remain controlled by its owner. Which TWO options close those specific gaps? Choose TWO.
- Symmetric encryption
- Public key
- Certificate revocation list (CRL)
- Full-disk encryption
- Private key
Correct Answers: B, E
Correct Answers
Answer B is correct because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. The fixed-count item needs this function in the answer set. Symmetric encryption covers encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data, a different requirement.
Answer E is correct because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. This selection maps directly to one of the named needs. Full-disk encryption addresses encryption that protects an entire storage device so data remains unreadable without authorized unlocking, so it does not satisfy the same slot. This question specifically tests the combined requirements represented by Public key and Private key.
Incorrect Answers
Answer A is incorrect because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. Every answer slot must map to a stated requirement. The correct set is Public key, Private key, so this option cannot replace one of those selections.
Answer C is incorrect because Certificate revocation list (CRL) means a published list of certificates that a certificate authority has revoked before their scheduled expiration. Every answer slot must map to a stated requirement. The correct set is Public key, Private key, so this option cannot replace one of those selections.
Answer D is incorrect because Full-disk encryption means encryption that protects an entire storage device so data remains unreadable without authorized unlocking. The fixed-count answer set is Public key, Private key; this option does not fill one of those named functions.
Question 7
A security engineer is working through a cryptographic architecture and PKI design review. The immediate requirement is alteration or obscuring of sensitive values so users or systems see realistic but protected representations. Which choice is the best fit?
- Wildcard certificate
- Data masking
- Public key infrastructure
- Key escrow
Correct Answer: B
Correct Answer
Answer B is correct because Data masking means alteration or obscuring of sensitive values so users or systems see realistic but protected representations. That makes it the best answer here; Public key infrastructure addresses the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Wildcard certificate means a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. This could be appropriate elsewhere, but the required function is alteration or obscuring of sensitive values so users or systems see realistic but protected representations; that makes Data masking the precise choice.
Answer C is incorrect because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. That concept can be valid in another scenario, but this question is testing alteration or obscuring of sensitive values so users or systems see realistic but protected representations; Data masking therefore fits the requirement more directly.
Answer D is incorrect because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The key mismatch is functional: Data masking addresses alteration or obscuring of sensitive values so users or systems see realistic but protected representations, the need stated by the question.
Question 8
During a cryptographic architecture and PKI design review, the team needs method that lets parties establish or agree on cryptographic key material over an untrusted network. Which option best meets this requirement?
- Key exchange
- Key management system
- Certificate revocation list (CRL)
- Online Certificate Status Protocol (OCSP)
Correct Answer: A
Correct Answer
Answer A is correct because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. The requirement maps directly to this function, whereas Key management system is aimed at a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation.
Incorrect Answers
Answer B is incorrect because Key management system means a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. That concept can be valid in another scenario, but this question is testing a method that lets parties establish or agree on cryptographic key material over an untrusted network; Key exchange therefore fits the requirement more directly.
Answer C is incorrect because Certificate revocation list (CRL) means a published list of certificates that a certificate authority has revoked before their scheduled expiration. The scenario instead requires a method that lets parties establish or agree on cryptographic key material over an untrusted network, which is why Key exchange is the better answer; this option serves the different function defined above.
Answer D is incorrect because Online Certificate Status Protocol (OCSP) means a protocol used to query the current revocation status of a specific certificate. The question is not asking for this function. It is testing a method that lets parties establish or agree on cryptographic key material over an untrusted network, so Key exchange is the stronger fit.
Question 9
A security engineer is working through a cryptographic architecture and PKI design review. The immediate requirement is replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. Which choice is the best fit?
- Asymmetric encryption
- Key escrow
- Transport encryption
- Tokenization
Correct Answer: D
Correct Answer
Answer D is correct because Tokenization means replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. The requirement maps directly to this function, whereas Asymmetric encryption is aimed at cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.
Incorrect Answers
Answer A is incorrect because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The scenario instead requires replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system, which is why Tokenization is the better answer; this option serves the different function defined above.
Answer B is incorrect because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The question is not asking for this function. It is testing replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system, so Tokenization is the stronger fit.
Answer C is incorrect because Transport encryption means encryption applied to communications while data moves between endpoints. This could be appropriate elsewhere, but the required function is replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system; that makes Tokenization the precise choice.
Question 10
During a cryptographic architecture and PKI design review, the team needs protocol used to query the current revocation status of a specific certificate. Which option best meets this requirement?
- Certificate authority
- Key exchange
- Online Certificate Status Protocol (OCSP)
- Salting
Correct Answer: C
Correct Answer
Answer C is correct because Online Certificate Status Protocol (OCSP) means a protocol used to query the current revocation status of a specific certificate. This matches the requirement as written. Salting can be valid in another context, but it is used for adding unique random data to a password before hashing it.
Incorrect Answers
Answer A is incorrect because Certificate authority means a trusted PKI entity that validates identity according to policy and digitally signs certificates. The key mismatch is functional: Online Certificate Status Protocol (OCSP) addresses a protocol used to query the current revocation status of a specific certificate, the need stated by the question.
Answer B is incorrect because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. This could be appropriate elsewhere, but the required function is a protocol used to query the current revocation status of a specific certificate; that makes Online Certificate Status Protocol (OCSP) the precise choice.
Answer D is incorrect because Salting means adding unique random data to a password before hashing it. The concept is valid, but it does not match this stem. The required function is a protocol used to query the current revocation status of a specific certificate, which maps to Online Certificate Status Protocol (OCSP).
Question 11
Two requirements remain open in a cryptographic architecture and PKI design review: centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation; alteration or obscuring of sensitive values so users or systems see realistic but protected representations. Which TWO options close those specific gaps? Choose TWO.
- Public key
- Wildcard certificate
- Data masking
- Key management system
- Key exchange
Correct Answers: C, D
Correct Answers
Answer C is correct because Data masking means alteration or obscuring of sensitive values so users or systems see realistic but protected representations. The fixed-count item needs this function in the answer set. Wildcard certificate covers a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com, a different requirement.
Answer D is correct because Key management system means a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. This selection maps directly to one of the named needs. Public key addresses the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder, so it does not satisfy the same slot.
Incorrect Answers
Answer A is incorrect because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. The question requires exactly 2 selections: Data masking, Key management system. This option falls outside that required set.
Answer B is incorrect because Wildcard certificate means a certificate that can secure multiple hostnames at one domain level through a wildcard name such as *.example.com. Every answer slot must map to a stated requirement. The correct set is Data masking, Key management system, so this option cannot replace one of those selections.
Answer E is incorrect because Key exchange means a method that lets parties establish or agree on cryptographic key material over an untrusted network. The fixed-count answer set is Data masking, Key management system; this option does not fill one of those named functions.
Question 12
A security plan created during a cryptographic architecture and PKI design review must provide secret half of an asymmetric key pair that must remain controlled by its owner, centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation, and replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. Which THREE options should be selected? Choose THREE.
- Key management system
- Transport encryption
- Secure enclave
- Salting
- Private key
- Tokenization
Correct Answers: A, E, F
Correct Answers
Answer A is correct because Key management system means a centralized service that controls the lifecycle of cryptographic keys, including creation, storage, rotation, and revocation. One required function is exactly what this option provides. Salting may be useful elsewhere, but it is used for adding unique random data to a password before hashing it.
Answer E is correct because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. The fixed-count item needs this function in the answer set. Transport encryption covers encryption applied to communications while data moves between endpoints, a different requirement.
Answer F is correct because Tokenization means replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. This selection maps directly to one of the named needs. Secure enclave addresses an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment, so it does not satisfy the same slot.
Incorrect Answers
Answer B is incorrect because Transport encryption means encryption applied to communications while data moves between endpoints. Every answer slot must map to a stated requirement. The correct set is Key management system, Private key, Tokenization, so this option cannot replace one of those selections.
Answer C is incorrect because Secure enclave means an isolated protected execution area used to keep sensitive code or cryptographic material separate from the normal operating environment. Every answer slot must map to a stated requirement. The correct set is Key management system, Private key, Tokenization, so this option cannot replace one of those selections.
Answer D is incorrect because Salting means adding unique random data to a password before hashing it. The scenario calls for Key management system, Private key, Tokenization. Selecting this option would leave one of those required functions uncovered. For example, Private key is required for the secret half of an asymmetric key pair that must remain controlled by its owner.
Question 13
A security engineer is working through a cryptographic architecture and PKI design review. The immediate requirement is request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance. Which choice is the best fit?
- Symmetric encryption
- Public key infrastructure
- Root of trust
- Certificate signing request (CSR)
Correct Answer: D
Correct Answer
Answer D is correct because Certificate signing request (CSR) means a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance. This matches the requirement as written. Root of trust can be valid in another context, but it is used for a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived.
Incorrect Answers
Answer A is incorrect because Symmetric encryption means encryption that uses the same secret key for encryption and decryption and is efficient for protecting large volumes of data. The concept is valid, but it does not match this stem. The required function is a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance, which maps to Certificate signing request (CSR).
Answer B is incorrect because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. The concept is valid, but it does not match this stem. The required function is a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance, which maps to Certificate signing request (CSR).
Answer C is incorrect because Root of trust means a highly trusted foundation, such as a root certificate or hardware anchor, from which other trust decisions are derived. That concept can be valid in another scenario, but this question is testing a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance; Certificate signing request (CSR) therefore fits the requirement more directly.
Question 14
The team is resolving a gap found during a cryptographic architecture and PKI design review: it needs published list of certificates that a certificate authority has revoked before their scheduled expiration. Which option is most appropriate?
- Key escrow
- Asymmetric encryption
- Certificate revocation list (CRL)
- Hardware security module (HSM)
Correct Answer: C
Correct Answer
Answer C is correct because Certificate revocation list (CRL) means a published list of certificates that a certificate authority has revoked before their scheduled expiration. The requirement maps directly to this function, whereas Key escrow is aimed at controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances.
Incorrect Answers
Answer A is incorrect because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The question is not asking for this function. It is testing a published list of certificates that a certificate authority has revoked before their scheduled expiration, so Certificate revocation list (CRL) is the stronger fit.
Answer B is incorrect because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. This could be appropriate elsewhere, but the required function is a published list of certificates that a certificate authority has revoked before their scheduled expiration; that makes Certificate revocation list (CRL) the precise choice.
Answer D is incorrect because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. The scenario instead requires a published list of certificates that a certificate authority has revoked before their scheduled expiration, which is why Certificate revocation list (CRL) is the better answer; this option serves the different function defined above.
Question 15
As part of a cryptographic architecture and PKI design review, reviewers identify a need for trusted PKI entity that validates identity according to policy and digitally signs certificates. Which option should they select?
- Online Certificate Status Protocol (OCSP)
- Certificate authority
- Public key infrastructure
- Hardware security module (HSM)
Correct Answer: B
Correct Answer
Answer B is correct because Certificate authority means a trusted PKI entity that validates identity according to policy and digitally signs certificates. The deciding point is functional fit: this option covers the stated need, while Public key infrastructure addresses the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.
Incorrect Answers
Answer A is incorrect because Online Certificate Status Protocol (OCSP) means a protocol used to query the current revocation status of a specific certificate. The question is not asking for this function. It is testing a trusted PKI entity that validates identity according to policy and digitally signs certificates, so Certificate authority is the stronger fit.
Answer C is incorrect because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. That concept can be valid in another scenario, but this question is testing a trusted PKI entity that validates identity according to policy and digitally signs certificates; Certificate authority therefore fits the requirement more directly.
Answer D is incorrect because Hardware security module (HSM) means a dedicated tamper-resistant device used to generate, protect, and perform operations with high-value cryptographic keys. The question is not asking for this function. It is testing a trusted PKI entity that validates identity according to policy and digitally signs certificates, so Certificate authority is the stronger fit.
Question 16
During a cryptographic architecture and PKI design review, the team has two independent requirements: (1) hardware-backed security component that can protect keys and attest to platform state; and (2) request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance. Which TWO choices best satisfy those requirements? Choose TWO.
- Trusted Platform Module (TPM)
- Certificate signing request (CSR)
- Asymmetric encryption
- Certificate revocation list (CRL)
- Data masking
Correct Answers: A, B
Correct Answers
Answer A is correct because Trusted Platform Module (TPM) means a hardware-backed security component that can protect keys and attest to platform state. One required function is exactly what this option provides. Data masking may be useful elsewhere, but it is used for alteration or obscuring of sensitive values so users or systems see realistic but protected representations.
Answer B is correct because Certificate signing request (CSR) means a request containing identifying information and a public key that is submitted to a certificate authority for certificate issuance. The fixed-count item needs this function in the answer set. Data masking covers alteration or obscuring of sensitive values so users or systems see realistic but protected representations, a different requirement.
Incorrect Answers
Answer C is incorrect because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The scenario calls for Trusted Platform Module (TPM), Certificate signing request (CSR). Selecting this option would leave one of those required functions uncovered.
Answer D is incorrect because Certificate revocation list (CRL) means a published list of certificates that a certificate authority has revoked before their scheduled expiration. Every answer slot must map to a stated requirement. The correct set is Trusted Platform Module (TPM), Certificate signing request (CSR), so this option cannot replace one of those selections.
Answer E is incorrect because Data masking means alteration or obscuring of sensitive values so users or systems see realistic but protected representations. The fixed-count answer set is Trusted Platform Module (TPM), Certificate signing request (CSR); this option does not fill one of those named functions.
Question 17
A security engineer is working through a cryptographic architecture and PKI design review. The immediate requirement is cryptographic value created with a private key and verified with the corresponding public key. Which choice is the best fit?
- Digital signature
- Asymmetric encryption
- Key stretching
- Certificate revocation list (CRL)
Correct Answer: A
Correct Answer
Answer A is correct because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key. That is the function the question is testing. Key stretching would instead be used for a technique that deliberately increases the computational cost of deriving a key from a password.
Incorrect Answers
Answer B is incorrect because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The key mismatch is functional: Digital signature addresses a cryptographic value created with a private key and verified with the corresponding public key, the need stated by the question.
Answer C is incorrect because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. That concept can be valid in another scenario, but this question is testing a cryptographic value created with a private key and verified with the corresponding public key; Digital signature therefore fits the requirement more directly.
Answer D is incorrect because Certificate revocation list (CRL) means a published list of certificates that a certificate authority has revoked before their scheduled expiration. The concept is valid, but it does not match this stem. The required function is a cryptographic value created with a private key and verified with the corresponding public key, which maps to Digital signature.
Question 18
A design decision in a cryptographic architecture and PKI design review must provide secret half of an asymmetric key pair that must remain controlled by its owner. Which choice most directly satisfies that requirement?
- Private key
- Key stretching
- Asymmetric encryption
- Key escrow
Correct Answer: A
Correct Answer
Answer A is correct because Private key means the secret half of an asymmetric key pair that must remain controlled by its owner. This is the precise fit for the scenario. Asymmetric encryption serves the different purpose of cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange.
Incorrect Answers
Answer B is incorrect because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. The scenario instead requires the secret half of an asymmetric key pair that must remain controlled by its owner, which is why Private key is the better answer; this option serves the different function defined above.
Answer C is incorrect because Asymmetric encryption means cryptography that uses mathematically related public and private keys for functions such as encryption, signatures, and key exchange. The key mismatch is functional: Private key addresses the secret half of an asymmetric key pair that must remain controlled by its owner, the need stated by the question.
Answer D is incorrect because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The scenario instead requires the secret half of an asymmetric key pair that must remain controlled by its owner, which is why Private key is the better answer; this option serves the different function defined above.
Question 19
A security engineer is working through a cryptographic architecture and PKI design review. The immediate requirement is shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. Which choice is the best fit?
- Public key infrastructure
- Public key
- Hashing
- Tokenization
Correct Answer: B
Correct Answer
Answer B is correct because Public key means the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder. This is the precise fit for the scenario. Public key infrastructure serves the different purpose of the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates.
Incorrect Answers
Answer A is incorrect because Public key infrastructure means the people, policies, processes, and technology used to issue, validate, manage, and revoke digital certificates. The scenario instead requires the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder, which is why Public key is the better answer; this option serves the different function defined above.
Answer C is incorrect because Hashing means a one-way transformation that produces a fixed-length digest and is commonly used to verify integrity. This could be appropriate elsewhere, but the required function is the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder; that makes Public key the precise choice.
Answer D is incorrect because Tokenization means replacement of sensitive data with a non-sensitive surrogate token that has little or no exploitable value outside the tokenization system. The key mismatch is functional: Public key addresses the shareable half of an asymmetric key pair, commonly used to verify signatures or encrypt material for the private-key holder, the need stated by the question.
Question 20
A design decision in a cryptographic architecture and PKI design review must provide controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. Which choice most directly satisfies that requirement?
- Digital signature
- Steganography
- Key stretching
- Key escrow
Correct Answer: D
Correct Answer
Answer D is correct because Key escrow means controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances. The deciding point is functional fit: this option covers the stated need, while Key stretching addresses a technique that deliberately increases the computational cost of deriving a key from a password.
Incorrect Answers
Answer A is incorrect because Digital signature means a cryptographic value created with a private key and verified with the corresponding public key. This could be appropriate elsewhere, but the required function is controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances; that makes Key escrow the precise choice.
Answer B is incorrect because Steganography means the concealment of information inside another apparently ordinary medium. The key mismatch is functional: Key escrow addresses controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, the need stated by the question.
Answer C is incorrect because Key stretching means a technique that deliberately increases the computational cost of deriving a key from a password. The key mismatch is functional: Key escrow addresses controlled storage of cryptographic keys so authorized recovery is possible under defined circumstances, the need stated by the question.
