CAS-004 Security Engineering Practice Question
A security engineer is selecting an asymmetric encryption algorithm for a system that must provide non-repudiation and long-term security (at least 20 years). The system has limited computational resources. Which of the following is the best choice?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ed25519
Ed25519 offers high security with small key sizes and efficient computation, and is suitable for long-term security. RSA 4096 is slower and has larger keys. ECDSA P-384 is secure but slower than Ed25519. DSA is older and less efficient.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RSA 4096
Why it's wrong here
RSA 4096 provides long-term security but requires more computation and larger keys.
- ✗
ECDSA P-384
Why it's wrong here
ECDSA P-384 is a digital signature algorithm, not an asymmetric encryption algorithm, making it unsuitable for the explicit requirement to encrypt data. While it provides non-repudiation and its P-384 curve offers excellent long-term security and computational efficiency for limited resources, these benefits apply to signing, not encryption. It would be a strong choice if the system only needed digital signatures for non-repudiation and integrity.
- ✓
Ed25519
Why this is correct
Ed25519 uses elliptic curves with 128-bit security, small keys, and fast operations, suitable for long-term security.
- ✗
DSA 3072
Why it's wrong here
DSA is older and less efficient; not recommended for new systems.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.