200-201 Security Concepts Practice Question
A security analyst is reviewing the cryptographic mechanisms used to protect data in transit and at rest. The organization wants to ensure confidentiality and integrity for sensitive files stored on a server and for data sent over a VPN. Which TWO of the following mechanisms provide both confidentiality and integrity for data? (Choose two.)
⚠ Common exam trap
The trap here is assuming that any strong cryptographic algorithm provides both confidentiality and integrity, when hashing and HMAC provide only integrity and encryption alone provides only confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AES-256 in CBC mode with HMAC-SHA256
AES-256 in GCM mode and AES-256 in CBC mode combined with HMAC-SHA256 both provide confidentiality and integrity. GCM is an authenticated encryption mode that includes an integrity tag, while CBC with HMAC uses separate encryption and authentication. SHA-256 and HMAC-SHA256 alone lack confidentiality, and RSA-2048 encryption alone lacks inherent integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HMAC-SHA256
Why it's wrong here
HMAC-SHA256 provides integrity and authenticity by using a secret key with a hash function, but it does not encrypt data, so it does not provide confidentiality. It is commonly used to verify message integrity in protocols like TLS, but it must be paired with an encryption algorithm to protect data confidentiality. Therefore it does not meet both requirements alone.
- ✗
SHA-256 hashing
Why it's wrong here
SHA-256 is a cryptographic hash function that provides integrity by producing a fixed-size digest, but it does not provide confidentiality because it is not reversible and does not encrypt data. It is often used alongside encryption, but on its own it cannot protect the confidentiality of files or VPN traffic. Therefore it does not meet both requirements.
- ✓
AES-256 in CBC mode with HMAC-SHA256
Why this is correct
AES-256 in CBC mode provides confidentiality by encrypting data, and combining it with HMAC-SHA256 provides integrity and authenticity through a keyed hash. This combination is a common approach in protocols like IPsec and TLS. Together they ensure both confidentiality and integrity for data in transit and at rest, satisfying the organization's requirements.
- ✓
AES-256 in GCM mode
Why this is correct
AES-256 in GCM mode is an authenticated encryption algorithm that provides both confidentiality through encryption and integrity through a message authentication code. It is widely used in VPNs and file encryption. GCM produces an authentication tag that detects tampering, satisfying both requirements for data in transit and at rest.
- ✗
RSA-2048 encryption
Why it's wrong here
RSA-2048 provides confidentiality through public-key encryption and can provide integrity when used with signatures, but encryption alone does not guarantee integrity. In practice, RSA is often combined with a hash for signatures, but as a standalone encryption mechanism it does not inherently provide integrity for the ciphertext. Thus it does not satisfy both requirements by itself.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.