Show IP Route Output Practice Questions

ECC

Why it fails: ECC is an asymmetric key-agreement and signature scheme built on elliptic-curve discrete logarithms, so it cannot perform bulk symmetric encryption of data at rest. It would be the right selection for key exchange, digital signatures or certificate public keys, not for ciphering stored data.

RSA

Why it fails: RSA is asymmetric, using a public/private key pair, and is far too slow for bulk data-at-rest encryption. It is correctly chosen for key transport, digital signatures or TLS handshake authentication, whereas symmetric ciphers such as AES handle the actual data encryption.

SHA-256

Why it fails: SHA-256 is a one-way hash producing a fixed 256-bit digest; it has no key and cannot be reversed, so it cannot encrypt data at rest. It is correctly used for integrity verification, password derivation within PBKDF2, or digital signature digests, not confidentiality.

Geolocation of source IPs

Why it fails: Geolocation of source IPs is enrichment metadata, not a volumetric or behavioural baseline metric, so it cannot establish normal traffic patterns. It is tempting because geographic origin is genuinely useful for alert triage and blocking, but baselining requires measurable counts such as flow volume and protocol distribution.

MAC addresses of devices

Why it fails: MAC addresses are static hardware identifiers that do not vary with traffic behaviour, so they cannot form a baseline of normal patterns. It is tempting because MAC addresses support asset inventory and rogue-device detection, but anomaly detection baselines require dynamic traffic metrics.

CPU utilization of servers

Why it fails: CPU is a system metric, not network.

Excessive connection attempts from a single IP

Why it fails: Excessive connection attempts from a single IP is a signature of scanning or brute-force activity, an anomaly rather than a normal-traffic metric. It is tempting because connection counts feed intrusion detection, which would be correct when alerting on deviations from an established baseline, not when building it.

Peak traffic times

Why it fails: Peak traffic times record when volume is highest, not the recurring volume, protocol and flow characteristics that constitute a traffic baseline. It is tempting because timing data supports capacity planning and scheduling, which would be correct for that purpose rather than for establishing normal-traffic metrics.

Unusual payload sizes

Why it fails: Unusual payload sizes describe anomalies deviating from established norms, so they cannot define the baseline itself. It is tempting because payload size analysis supports anomaly detection, which would be correct when comparing live traffic against an already-documented baseline rather than constructing one.

Asymmetric encryption is used only for hashing

Why it fails: Hashing is a separate one-way operation, not a category of asymmetric encryption, which encrypts and decrypts with a public-private key pair. It is tempting because both appear in certificate and signature workflows, but the primary distinction remains key structure and distribution between symmetric and asymmetric ciphers.

Symmetric uses two keys, asymmetric uses one

Why it fails: The key counts are reversed: symmetric encryption uses one shared key, while asymmetric uses a mathematically related public and private key pair. It is tempting because both involve keys, but the actual axis of difference is key distribution, since symmetric requires secure sharing of the single secret key.

Symmetric is slower than asymmetric

Why it fails: Symmetric algorithms are faster than asymmetric ones, so the comparison is inverted. It is tempting because speed is a genuine practical difference, but the primary distinction concerns key structure: one shared secret key versus a public-private key pair, which determines how keys are distributed and exchanged.

Digital signature

Why it fails: A digital signature provides authenticity, integrity and non-repudiation by signing a hash with the sender's private key; verification uses the corresponding public key, so no shared secret exists. It is tempting because it also uses hashing and keys, but it is asymmetric and performs no symmetric encryption of data.

RSA

Why it fails: RSA is asymmetric: encryption uses the recipient's public key and decryption the matching private key, so two distinct keys are involved. It is tempting because RSA is the best-known cryptographic algorithm, but it is slower than symmetric ciphers and therefore fails the same-key requirement in the stem.

SHA-256

Why it fails: SHA-256 is a one-way cryptographic hash producing a fixed 256-bit digest; it performs no encryption or decryption and has no key at all. It is tempting because it is fast and keyed variants exist, but hashing is used for integrity verification, not for confidential data encryption.