Cryptography and access control — the two mechanisms that decide who gets to see what information and how that information stays secret. For the 200-201 exam, you need to understand not just what these terms mean, but how they work together to protect networks, data, and systems from attackers who want to read, change, or steal what they shouldn’t.
Jump to a section
A simple way to picture Cryptography and Access Control
You move into an apartment building with exactly 100 units. The building has three different locks: a front door key, a mailbox key, and a safe-deposit box key at the lobby bank. Each key opens exactly one thing. The front door key lets you into the building and your apartment — think of this as your identity. The mailbox key opens your small slot where the postman drops letters — that’s your data at rest, stored and waiting. The safe-deposit box key opens a box inside a vault that only you and the bank manager can access — that’s your most sensitive data, encrypted with a special key.
Now imagine you want to give a friend temporary access to pick up a package from your mailbox while you’re on holiday. You can’t just hand over your front door key — that would let them into your entire apartment. Instead, you create a temporary copy of just the mailbox key, give it to the friend, and set it to expire after 48 hours. This is exactly like an access control list (ACL) or a role-based permission in IT. You control who can open which lock, for how long, and what they can do once inside.
The building manager also keeps a log every time a key is used — front door, mailbox, or safe-deposit box. If someone tries to use a copied key that has expired, the log records a failed attempt. This log is your audit trail, and the expired key is like a revoked certificate or expired session token. Cryptography is the set of mathematical rules that make these keys unguessable and unique. Access control is the system that decides which keys belong to which person. Together, they ensure that only the right people access the right data at the right time.
Cryptography is the science of hiding information. It transforms readable data (called plaintext) into unreadable data (called ciphertext) using a mathematical recipe called an algorithm. Think of it as scrambling a message so that only someone with the correct key can unscramble it. The whole point is to protect confidentiality — ensuring that unauthorised people cannot read the data. It also provides integrity — proving the data has not been tampered with — and authentication — verifying the identity of the sender.
There are three main types of cryptography you need to know for 200-201:
Symmetric encryption: Uses one single key to both encrypt and decrypt data. It is fast and efficient, ideal for encrypting large amounts of data. The problem is that the key must be shared securely between sender and receiver. If someone intercepts the key during sharing, they can decrypt everything. Common symmetric algorithms include AES (Advanced Encryption Standard) and 3DES (Triple Data Encryption Standard).
Asymmetric encryption: Uses a pair of keys — a public key that anyone can see, and a private key that only the owner keeps secret. You can encrypt with the public key and decrypt only with the private key. This solves the key-sharing problem because you don’t need to send the private key anywhere. However, asymmetric encryption is much slower than symmetric encryption. RSA and ECC (Elliptic Curve Cryptography) are examples.
Hashing: A one-way mathematical function that turns any amount of data into a fixed-length string of characters, called a hash or digest. You cannot reverse a hash to get the original data. Hashing is used to verify data integrity — if the data changes even slightly, the hash changes completely. Common hash algorithms are SHA-256 (part of the SHA-2 family) and MD5 (which is now considered broken and insecure for many uses).
Access control is the system that determines who is allowed to do what with a given resource. It is not the same as cryptography, but the two work together. Cryptography protects the data itself; access control protects the entry points. The 200-201 exam focuses on three main access control models:
Discretionary Access Control (DAC): The owner of a resource decides who can access it. In a file system, for example, the person who creates a file can set permissions for other users. The owner has full discretion.
Mandatory Access Control (MAC): A central authority, such as an operating system or security policy, sets the rules. Users cannot override these rules. MAC is stricter than DAC and is used in high-security environments like military systems.
Role-Based Access Control (RBAC): Access permissions are grouped by job role. Instead of giving each user individual permissions, you assign them to a role (like “network administrator” or “security analyst”) and the role has predefined permissions. This is the most common model in enterprise environments because it is easier to manage at scale.
Why does this all matter for a 200-201 candidate? Because real-world attacks often involve breaking one or both of these systems. An attacker might intercept encrypted traffic if the encryption is weak or the key is poorly managed. Or they might exploit a misconfigured access control list to read sensitive files without needing to break any encryption at all. The exam tests whether you understand both the strengths and limitations of each approach, and how to combine them effectively.
Step 1: Identify the data to protect
The first step in any cryptographic or access control plan is to determine what data needs protection. This could be customer payment details, internal emails, or login credentials. Without this step, you cannot decide which tools (encryption, hashing, access control lists) to apply.
Step 2: Choose the appropriate encryption type
For data in transit (like web traffic), use asymmetric encryption to exchange a session key, then symmetric encryption for bulk data. For data at rest (like files on a hard drive), use symmetric encryption like AES-256. The choice depends on the use case and performance requirements.
Step 3: Implement hashing for integrity checks
After encrypting data, compute a hash of the original plaintext and store it separately. When the data is later retrieved, recompute the hash and compare. If the hashes match, the data has not been altered. This is how systems detect tampering.
Step 4: Define access control rules using an appropriate model
Based on the organisation’s security policy, choose DAC, MAC, or RBAC. For most enterprises, RBAC is the best choice. Create roles (e.g., “finance analyst”, “auditor”) and assign permissions (read, write, execute) to each role. Then assign users to roles. Document every rule.
Step 5: Apply the rules through an access control list (ACL)
An ACL is a list of permissions attached to a resource (like a file, folder, or database). The ACL tells the system which users or roles can perform which actions. For example, an ACL on a customer database might grant read access to support agents but deny write access. The system checks the ACL every time a request is made.
Step 6: Monitor, log, and audit access attempts
Enable logging for all access attempts, both successful and failed. Review logs regularly to spot anomalies, such as repeated failed login attempts or a user accessing data outside their normal pattern. This step turns a static policy into an active defence.
Step 7: Rotate keys and review permissions periodically
Encryption keys should be rotated every 90 days or immediately after a suspected compromise. Access permissions should be reviewed quarterly to remove unused roles or revoke access for former employees. This step prevents stale credentials from becoming a vulnerability.
An IT professional working in a security operations centre (SOC) uses cryptography and access control every day. Imagine a mid-sized company with 500 employees, a web application that handles customer payment data, and a remote workforce. The SOC analyst’s job is to ensure that only authorised people can access the payment database and that the data is encrypted both when stored and when transmitted.
Step by step, here is what the analyst actually does: First, they configure the web application to use HTTPS (Hypertext Transfer Protocol Secure). HTTPS uses TLS (Transport Layer Security), which combines asymmetric encryption to exchange a session key and symmetric encryption to encrypt all subsequent traffic. The analyst ensures that the server’s TLS certificate is valid and issued by a trusted Certificate Authority (CA). This certificate proves the server’s identity and contains its public key. Without this step, all customer data sent over the internet would be in plaintext and easily intercepted.
Second, they set up an access control system for the database. Using RBAC, they create three roles:
Database administrators (DBAs): Full read/write access to all tables.
Customer support agents: Read-only access to customer names and addresses, but no access to payment card numbers.
Security auditors: Read-only access to logs and metadata, but not the actual data.
Each employee is assigned to exactly one role. If a support agent tries to run a query that returns payment card numbers, the database access control list (ACL) blocks the query and logs the attempt. The analyst reviews these logs daily to spot unusual access patterns — for example, a DBA querying customer data at 3 a.m. when they normally work 9-to-5.
Third, they implement encryption at rest. The payment database is encrypted using AES-256, meaning that even if an attacker steals the physical hard drives, the data is unreadable without the encryption key. The key itself is stored in a hardware security module (HSM) or a cloud key management service (KMS), not on the same server as the database. The analyst regularly rotates the encryption keys — every 90 days is a common policy — and revokes old keys immediately if a compromise is suspected.
Finally, they test the system. They simulate a phishing attack where a fake email tricked a support agent into revealing their login credentials. Even though the attacker now has the support agent’s username and password, the access control system limits them to read-only customer names and addresses, not payment data. And even if the attacker tries to exfiltrate those names and addresses, the data is encrypted in transit by HTTPS. The analyst notes this scenario in a security report and recommends additional training for the support team. This is the daily reality of IT security: combining cryptography and access control to create multiple layers of defence.
The 200-201 exam tests cryptography and access control in several specific ways. You will not be asked to perform complex cryptographic calculations, but you will need to know the characteristics, strengths, and weaknesses of each type. Expect around 10–15 questions on these topics, mixed across multiple-choice and drag-and-drop formats.
Key concepts they love to test:
Difference between symmetric and asymmetric encryption: You must know which is faster (symmetric), which is better for key exchange (asymmetric), and that both are often used together in protocols like TLS.
Hashing vs encryption: A common trick question asks whether a hash can be reversed (no) and whether encryption can be reversed (yes, with the correct key). Memorise that hashing provides integrity, not confidentiality.
Access control models: You will be given a scenario and asked to identify whether it describes DAC, MAC, or RBAC. For example, “A system administrator sets a policy that all marketing employees can read the marketing folder, and no one can override this” — that is MAC, not RBAC.
Trap patterns to watch for: - “Which encryption algorithm is best for encrypting a large file?” The answer is a symmetric algorithm like AES, not asymmetric like RSA. Asymmetric is too slow for bulk data. - “What does a digital signature provide?” A digital signature provides authentication, non-repudiation (the sender cannot deny sending), and integrity. It does NOT provide confidentiality — the message itself can still be read. - “Which access control model allows the resource owner to set permissions?” That is DAC. Many beginners pick RBAC because it is more common in the workplace, but the question is specifically about who sets permissions, not how they are organised.
Key definitions to memorise:
Cipher: The algorithm used for encryption or decryption.
Key: The secret value used by the cipher to transform data. A key is not the same as a password — it is longer, more random, and generated by a cryptographic process.
PKI (Public Key Infrastructure): The entire system of certificates, CAs, and policies that supports asymmetric encryption. You need to know that a CA (Certificate Authority) is a trusted third party that issues digital certificates.
Integrity: Ensures data has not been modified. Achieved through hashing.
Non-repudiation: Ensures that a sender cannot deny having sent a message. Achieved through digital signatures.
The exam also expects you to know that Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management service that implements RBAC. If a question mentions cloud-based access control with roles and policies, the answer is often Microsoft Entra ID or a similar service like AWS IAM.
Symmetric encryption uses one key for both encryption and decryption, making it fast but requiring secure key exchange.
Asymmetric encryption uses a public and private key pair, solving key exchange but being slower than symmetric methods.
Hashing is a one-way function that verifies data integrity and cannot be reversed to reveal the original data.
Discretionary Access Control (DAC) lets resource owners set permissions, whereas Mandatory Access Control (MAC) enforces system-wide rules that users cannot override.
Role-Based Access Control (RBAC) groups permissions by job role, simplifying management in large organisations.
HTTPS encrypts data only in transit, not at rest on the server, so access control and encryption at rest are still necessary.
A digital signature provides authentication, integrity, and non-repudiation, but does not provide confidentiality.
PKI (Public Key Infrastructure) is the system of certificates and Certificate Authorities that underpins secure internet communication.
These come up on the exam all the time. Here's how to tell them apart.
Symmetric Encryption
Uses a single key for both encryption and decryption.
Faster and more efficient for large amounts of data.
Key must be securely shared between sender and receiver.
Asymmetric Encryption
Uses a pair of keys: public and private.
Slower, typically used for small data or key exchange.
No need to share the private key; public key can be openly distributed.
Encryption
Two-way: encrypted data can be decrypted with the correct key.
Provides confidentiality by hiding the original data.
Output length is the same as or longer than input (depending on algorithm).
Hashing
One-way: a hash cannot be reversed to reveal the original data.
Provides integrity by detecting changes to data.
Output is a fixed-length string, regardless of input size.
Role-Based Access Control (RBAC)
Permissions are assigned to roles, not directly to users.
Centrally managed by an administrator or policy.
More scalable for large organisations with many users.
Discretionary Access Control (DAC)
Permissions are assigned directly to users by the resource owner.
Decentralised: each owner decides who can access their resources.
Less scalable; prone to inconsistent permissions and human error.
Mandatory Access Control (MAC)
System-wide policy enforces access; users cannot override.
Used in high-security environments like military or government.
Labels (e.g., classification levels) are applied to both users and resources.
Discretionary Access Control (DAC)
Resource owner decides who can access their resources.
Common in typical file systems like Windows or Linux.
No central policy; owners can grant access to anyone.
Mistake
Encryption and hashing are the same thing because both scramble data.
Correct
Encryption is a two-way process (you can decrypt with the key), while hashing is a one-way process (you cannot retrieve the original data from the hash). Encryption provides confidentiality; hashing provides integrity.
Because both produce seemingly random output, beginners assume they are interchangeable. The exam tests this exact distinction.
Mistake
Symmetric encryption is always less secure than asymmetric encryption.
Correct
Symmetric encryption (like AES-256) is extremely secure if the key is kept secret. Asymmetric encryption is not inherently more secure; it just solves the key distribution problem. A weak key in asymmetric encryption can still be broken.
People think 'more complex' means 'more secure'. Symmetric algorithms are simpler but can be just as strong when properly implemented.
Mistake
HTTPS means the entire connection is encrypted from end to end, including the server's internal processing.
Correct
HTTPS encrypts only the data in transit between the browser and the server. Once the data reaches the server, it may be decrypted for processing and could be stored in plaintext. Access control on the server is still needed.
The padlock icon in browsers gives a false sense of total security. The exam tests that HTTPS does not protect data after it arrives at the server.
Mistake
RBAC and DAC are the same because both involve granting permissions to users.
Correct
In DAC, individual resource owners set permissions. In RBAC, permissions are tied to roles, not individuals, and are centrally managed. RBAC is more scalable and less prone to human error.
Both involve users and permissions, so beginners conflate them. The exam tests the difference in control structure, not just the presence of permissions.
Mistake
A longer key always means a more secure algorithm.
Correct
Key length matters, but the algorithm's design is equally important. AES with a 256-bit key is secure. Using a 256-bit key with a weak algorithm is still insecure. Also, some algorithms with shorter keys (like ECC 256-bit) can be as secure as RSA with a much longer key.
Beginners fixate on the key length because it is a simple number to compare. The exam tests algorithm choice over key length alone.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A cipher is the algorithm or formula that performs the encryption. A key is a specific secret value that the cipher uses to produce a unique output. You can think of the cipher as the lock design and the key as the actual key that fits that lock.
Hashing is one-way and cannot be reversed, so if a database of password hashes is stolen, the attacker cannot easily recover the original passwords. Encryption is two-way, meaning if the encryption key is stolen, all passwords can be decrypted. Hashing is therefore safer for storing passwords.
No. Hashing does not use a key in the same way encryption does. Some hashing functions (like HMAC) do use a secret key, but the purpose is to create a message authentication code, not to encrypt data. Standard hashing (like SHA-256) is keyless.
Encryption at rest means that data stored on a hard drive, database, or other storage medium is encrypted by the storage system itself. Even if the physical drive is stolen, the data is unreadable without the decryption key. It complements encryption in transit (like HTTPS).
RBAC centralises permission management and reduces human error because permissions are defined by role rather than granted individually. If an employee changes roles, you simply update their role assignment instead of revoking a dozen individual permissions. DAC relies on individual owners, who may not follow security best practises.
A Certificate Authority is a trusted organisation that issues digital certificates to verify the identity of websites, servers, or individuals. Without a CA, you would have no way to know if a public key really belongs to the claimed owner. CAs are a core part of the Public Key Infrastructure (PKI).
You've finished Cryptography and Access Control. Continue through the 200-201 study guide to build a complete picture of the exam.
Done with this chapter?