SSCP Cryptography — 20 Questions

Question 1

A company wants to ensure that data transmitted between its two branch offices remains confidential. Which cryptographic goal is primarily being addressed?

Accepted Answer

Confidentiality. Confidentiality ensures that data is accessible only to authorized parties, typically achieved through encryption. In this scenario, the company wants to prevent unauthorized interception of data between branch offices, which is the core goal of confidentiality. Technologies such as IPsec VPNs or TLS are used to encrypt the data in transit, directly addressing this requirement.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 2

A security administrator needs to choose an encryption algorithm for a high-speed network where data is encrypted at the link layer. Which algorithm is most appropriate?

Accepted Answer

AES. AES (Advanced Encryption Standard) is the most appropriate choice for link-layer encryption in high-speed networks because it is a symmetric block cipher designed for efficient hardware and software implementation, offering high throughput with low latency. Unlike asymmetric algorithms, AES operates with a single shared key, making it ideal for encrypting bulk data at the data link layer where speed and minimal overhead are critical.

Answer

RSA

Answer

Diffie-Hellman

Answer

SHA-256

Question 3

A system administrator notices that a server's certificate was issued by a CA that is not in the trusted root store of client machines. What is the most likely impact on clients connecting via TLS?

Accepted Answer

Clients will receive a certificate warning or be unable to connect.. When a server presents a certificate issued by a Certificate Authority (CA) that is not in the client's trusted root store, the TLS handshake fails the trust chain validation. The client's TLS library (e.g., OpenSSL, Schannel) will either display a certificate warning to the user or terminate the connection with an error such as 'SEC_ERROR_UNKNOWN_ISSUER' in Firefox or 'ERR_CERT_AUTHORITY_INVALID' in Chrome, depending on the client's security policy.

Answer

The server will automatically obtain a new certificate.

Answer

Clients will connect but with reduced cipher strength.

Answer

Clients will be able to connect without any warning.

Question 4

When implementing a digital signature, which key is used to create the signature?

Accepted Answer

Sender's private key. In a digital signature scheme, the sender uses their own private key to create the signature. This ensures non-repudiation because only the sender possesses that private key, and the corresponding public key can verify the signature. The process involves encrypting a hash of the message with the sender's private key, as specified in standards like PKCS#1 and RFC 8017.

Answer

Receiver's private key

Answer

Sender's public key

Answer

Receiver's public key

Question 5

A company's policy requires that all data at rest be encrypted. Which of the following is the most effective method to encrypt files on a laptop?

Accepted Answer

Implement full disk encryption (FDE).. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, swap files, temporary files, and all user data. This ensures that if the laptop is lost or stolen, all data at rest is protected without relying on the user to selectively encrypt files or folders, which can leave sensitive data exposed in unencrypted system areas.

Answer

Encrypt only the user's home folder.

Answer

Encrypt individual files using a symmetric key.

Answer

Use a self-extracting encrypted archive.

Question 6

Which TWO of the following are symmetric encryption algorithms? (Select exactly two.)

Accepted Answer

DES. DES (Data Encryption Standard) is a symmetric encryption algorithm that uses a single key for both encryption and decryption. It operates on 64-bit blocks with a 56-bit key, and while now considered insecure due to its small key size, it remains a foundational symmetric cipher. AES (Advanced Encryption Standard) is also symmetric, using block sizes of 128 bits and key sizes of 128, 192, or 256 bits, and is the current standard for symmetric encryption.

Answer

RSA

Answer

ECC

Answer

SHA-256

Question 7

Which THREE of the following are common use cases for public key infrastructure (PKI)? (Select exactly three.)

Accepted Answer

Digital signatures. Digital signatures are a core use case for PKI because they rely on asymmetric cryptography where a private key signs data and the corresponding public key, bound to an identity via a digital certificate issued by a Certificate Authority (CA), verifies the signature. This ensures authenticity, integrity, and non-repudiation of the signed message or document.

Answer

Password hashing

Answer

Symmetric key exchange

Question 8

Refer to the exhibit. An administrator runs an OpenSSL s_client command and receives the output shown. What is the most likely cause of the 'unable to get local issuer certificate' error?

Accepted Answer

The client does not trust the issuing CA.. The 'unable to get local issuer certificate' error from OpenSSL s_client indicates that the client (the machine running the command) does not have the issuing Certificate Authority (CA) certificate in its trust store. This means the client cannot verify the server certificate's chain of trust. Option B is correct because the error specifically points to a missing or untrusted CA certificate on the client side, not a problem with the server's private key, self-signing, or expiration.

Answer

The server's private key is missing.

Answer

The server certificate is self-signed.

Answer

The server certificate has expired.

Question 9

Refer to the exhibit. A network engineer is configuring an IPsec VPN. Which protocol does this configuration apply to?

Accepted Answer

IKE (Internet Key Exchange). The configuration shown in the exhibit is for an IPsec VPN, which relies on IKE (Internet Key Exchange) to establish security associations and negotiate cryptographic keys. IKE (RFC 7296) is the mandatory key management protocol for IPsec, handling authentication and key exchange over UDP ports 500 and 4500. Without IKE, IPsec cannot dynamically negotiate the encryption and hashing parameters required for secure tunnel establishment.

Answer

HTTPS

Answer

SSH

Answer

SSL/TLS

Question 10

A mid-sized company has deployed a web application that handles sensitive customer data. The application uses TLS to encrypt data in transit. Recently, the company received a penetration test report indicating that an attacker could potentially downgrade the TLS connection to an older, weaker version (e.g., TLS 1.0) by performing a man-in-the-middle attack. The application server runs on Windows Server 2022 with IIS 10. The security team wants to disable all versions of TLS below 1.2 on the server. However, after making registry changes to disable TLS 1.0 and 1.1, some legacy clients that only support TLS 1.0 are unable to connect. The business requires that these legacy clients still be able to access the application securely, but the security team insists on disabling weak protocols. The server currently has a valid certificate from a public CA. Which of the following is the most appropriate course of action?

Accepted Answer

Deploy a TLS-terminating reverse proxy that supports both strong and legacy TLS, placing it in front of the web server.. Option C is correct because deploying a TLS-terminating reverse proxy allows the server to enforce TLS 1.2+ on the backend while the proxy handles legacy TLS 1.0 connections from older clients. This satisfies both the security requirement to disable weak protocols on the origin server and the business need to support legacy clients, without exposing the server to downgrade attacks. The proxy can be configured with separate TLS policies per listener, ensuring that only the proxy accepts weaker TLS versions while the IIS server remains locked down.

Answer

Switch the application to use a VPN instead of TLS for legacy client access.

Answer

Upgrade all legacy clients to support TLS 1.2 or later immediately.

Answer

Re-enable TLS 1.0 and 1.1 on the server, as the business requirement outweighs security concerns.

Question 11

Drag and drop the steps for a typical TLS 1.3 handshake into the correct order.

Question 12

Match each disaster recovery site type to its description.

Question 13

A security administrator needs to store sensitive customer data in a database. To protect the data at rest, which encryption method should be used?

Accepted Answer

AES-256 in CBC mode. AES-256 in CBC mode is the correct choice because it is a strong, widely accepted symmetric encryption algorithm that provides confidentiality for data at rest. AES-256 uses a 256-bit key, making it resistant to brute-force attacks, and CBC mode adds an initialization vector (IV) to ensure that identical plaintext blocks produce different ciphertext, preventing pattern leakage. This combination is recommended by standards such as NIST SP 800-38A for protecting sensitive stored data.

Answer

RSA-2048

Answer

Blowfish in CTR mode

Answer

DES in ECB mode

Question 14

An organization wants to ensure that a software update has not been tampered with during download. Which cryptographic technique should be used?

Accepted Answer

Sign the update with the developer's private key. Signing the update with the developer's private key provides both integrity and authenticity. When the user verifies the signature using the developer's public key, they can confirm that the update has not been tampered with and that it originated from the claimed developer. This is the standard approach for ensuring trust in software distribution, as used in code signing certificates (e.g., Authenticode, GPG).

Answer

Compute a SHA-256 hash of the update

Answer

Encrypt the update with AES

Answer

Append a MAC (Message Authentication Code)

Question 15

A security professional is implementing a solution to verify the authenticity of a digital certificate. Which component of a PKI is responsible for issuing and revoking certificates?

Accepted Answer

Certificate Authority (CA). The Certificate Authority (CA) is the core component of a Public Key Infrastructure (PKI) responsible for issuing digital certificates and, crucially, for revoking them when they are no longer trusted. While other components support certificate status checking or verification, only the CA has the authority to sign and publish certificates or revocation information.

Answer

Online Certificate Status Protocol (OCSP) responder

Answer

Certificate Revocation List (CRL)

Answer

Registration Authority (RA)

Question 16

A company deploys a web application that handles sensitive financial transactions. To protect data in transit, which protocol should be used?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct choice because it is the industry-standard protocol for securing HTTP traffic, providing encryption, integrity, and authentication for data in transit. It is widely supported, has no known practical vulnerabilities (unlike SSL 3.0), and is specifically designed for web application protocols like HTTPS, making it ideal for protecting sensitive financial transactions.

Answer

SSH (Secure Shell)

Answer

SSL 3.0

Answer

IPsec in transport mode

Question 17

A system administrator is configuring a file encryption solution for a shared network drive. The solution must allow multiple users to read the files without sharing a single symmetric key. Which approach should be used?

Accepted Answer

Encrypt the file with a symmetric key, then encrypt that key with each authorized user's public key. Option C describes hybrid encryption, which is the correct approach for this scenario. The file is encrypted with a random symmetric key (session key) for efficiency, and that symmetric key is then encrypted with each authorized user's public key. This allows multiple users to decrypt the symmetric key with their private key and then decrypt the file, without sharing a single symmetric key.

Answer

Use a different symmetric key for each user and re-encrypt the file for each user

Answer

Encrypt the file with each user's public key directly

Answer

Encrypt the file with a single symmetric key and share that key securely with all users

Question 18

A security analyst reviews a cryptographic implementation and notices that the same initialization vector (IV) is used repeatedly with the same key in CBC mode. What is the primary risk?

Accepted Answer

Loss of confidentiality. In CBC (Cipher Block Chaining) mode, the initialization vector (IV) is XORed with the first plaintext block before encryption. Reusing the same IV with the same key means that identical plaintext blocks will produce identical ciphertext blocks, revealing patterns in the data. This directly breaks confidentiality, as an attacker can detect repeated plaintext segments, infer message structure, or even recover plaintext through known-plaintext attacks.

Answer

Loss of authentication

Answer

Non-repudiation is compromised

Answer

Loss of integrity

Question 19

An organization wants to implement a cryptographic solution that ensures forward secrecy for its internal communications. Which key exchange method should be used?

Accepted Answer

Diffie-Hellman Ephemeral (DHE). DHE (Diffie-Hellman Ephemeral) generates a fresh, temporary key pair for each session and never reuses the private key, ensuring that compromise of a long-term key does not expose past session keys. This provides forward secrecy because the ephemeral keys are destroyed after the session ends, making it computationally infeasible to decrypt recorded traffic even if the server's static key is later compromised.

Answer

RSA key exchange

Answer

Elliptic Curve Diffie-Hellman (ECDH)

Answer

Static Diffie-Hellman

Question 20

A security engineer is designing a system to store passwords securely. Which of the following is the most robust approach for password storage?

Accepted Answer

Use bcrypt with a high cost factor. Bcrypt is the most robust option because it incorporates a salt to defend against rainbow table attacks and uses a configurable cost factor to deliberately slow down the hashing process, making brute-force attacks computationally expensive. Unlike general-purpose hashes like SHA-256, bcrypt is designed specifically for password storage and resists GPU-accelerated attacks by requiring significant memory and time per attempt.

Answer

Hash passwords with SHA-256

Answer

Encode passwords with Base64

Answer

Encrypt passwords using AES-256 and store the key separately