mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Is evaluating the use of AES-256-GCM for…
Exhibit
Refer to the exhibit. Exhibit: ``` Cipher: AES256-GCM Mode: GCM Key size: 256 bits IV size: 12 bytes Tag size: 16 bytes AAD: "" ```
A security engineer is evaluating the use of AES-256-GCM for encrypting sensitive data in transit. They note that the Additional Authenticated Data (AAD) field is empty. What is the security implication?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cipher is secure, but the missing AAD may allow an attacker to replace the ciphertext with another valid ciphertext from a different context, causing a potential mix-and-match attack.
In AES-256-GCM, the Additional Authenticated Data (AAD) provides context binding, ensuring that the ciphertext is authentic only within a specific context (e.g., a particular session or transaction). When AAD is empty, an attacker who has access to multiple valid ciphertexts (each with its own context) could potentially swap them without detection, leading to a mix-and-match attack. The cipher still provides authentication (via the authentication tag) and confidentiality, but without AAD, the binding to the intended context is lost. Option B is wrong because missing AAD does not directly affect protection against man-in-the-middle attacks; the cipher still provides integrity and authentication. Option C is wrong because AES-256-GCM provides authentication through its GMAC authentication tag, even without AAD. Option D is wrong because AAD has no impact on key recovery; GCM is secure against key recovery attacks regardless of AAD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The cipher is secure, but the missing AAD may allow an attacker to replace the ciphertext with another valid ciphertext from a different context, causing a potential mix-and-match attack.
Why this is correct
Without AAD, an attacker could take a valid ciphertext from one session and insert it into another, if the same key is used, leading to potential data confusion.
- ✗
The cipher is still secure, but missing AAD offers no additional protection against man-in-the-middle attacks.
Why it's wrong here
AAD is used to bind the ciphertext to a specific context; missing it can allow replay or substitution in different contexts, but the cipher's authentication still prevents tampering within the same context.
- ✗
The encryption provides no authentication because AAD is missing.
Why it's wrong here
GCM inherently provides authentication via the tag; AAD is extra authenticated data but not required for basic authentication.
- ✗
The cipher becomes vulnerable to key recovery attacks because AAD is missing.
Why it's wrong here
AAD does not affect the key; key recovery would involve brute force or weaknesses in the cipher, not AAD.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.