mediumMultiple SelectObjective-mapped
CAS-004 Practice Question: Which TWO of the following are considered secure…
Which TWO of the following are considered secure design principles for cryptographic systems?
⚠ Common exam trap
CompTIA often tests the misconception that 'custom algorithms' or 'security through obscurity' can be acceptable in secure design, when in fact they are explicitly rejected in favor of open, peer-reviewed standards and key separation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use well-vetted, standard cryptographic algorithms
Using well-vetted, standard cryptographic algorithms (e.g., AES, RSA, ECDSA) ensures the system benefits from years of public scrutiny, rigorous cryptanalysis, and proven security properties. Proprietary or custom algorithms often contain undiscovered vulnerabilities, making them unsuitable for secure systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement custom encryption algorithms designed in-house
Why it's wrong here
Custom algorithms are prone to flaws.
- ✗
Use the same key for encryption and authentication to reduce complexity
Why it's wrong here
Key separation is important; reusing keys can lead to vulnerabilities.
- ✓
Use well-vetted, standard cryptographic algorithms
Why this is correct
Standard algorithms have been analyzed for weaknesses.
- ✗
Rely on secrecy of the algorithm for security
Why it's wrong here
Security should not depend on algorithm secrecy (Kerckhoffs's principle).
- ✓
Generate cryptographic keys using a cryptographically secure random number generator
Why this is correct
Weak randomness can lead to predictable keys.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.