GSEC Cryptography Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Counter Mode (CTR)

  Why this is correct

  CTR turns a block cipher into a stream cipher by encrypting sequential counter values, so any block can be decrypted independently once the correct counter value is known. This allows parallel processing and random access, which suits a low-CPU tape appliance and a multi-gigabyte archive. The engineer must still ensure counter values are never reused with the same key, but CTR meets the independent-chunk requirement without the chaining dependency of CBC.

• ✗

  Cipher Block Chaining (CBC)

  Why it's wrong here

  CBC chains each ciphertext block into the next block's encryption, so any block can only be decrypted after all preceding blocks are processed. On a tape appliance with limited CPU, the serial dependency prevents parallel decryption and makes random access to a 40 GB archive impractical. CBC also requires careful IV management and padding, which adds complexity without delivering the independent-chunk capability the engineer needs.

• ✗

  Galois/Counter Mode (GCM)

  Why it's wrong here

  GCM is an authenticated encryption mode that provides confidentiality and integrity, but its authentication tag covers the entire message, so verification requires processing the whole stream. That conflicts with decrypting the archive in independent chunks. GCM also demands unique nonces per key; reusing a nonce with the same key catastrophically breaks confidentiality and authenticity, which is a serious operational risk for a long-lived archival key.

• ✗

  Electronic Codebook (ECB)

  Why it's wrong here

  ECB encrypts each block independently, so it technically permits random access, but it leaks plaintext patterns because identical plaintext blocks produce identical ciphertext blocks. A structured database backup contains highly repetitive blocks, so ECB would expose that structure in the archived ciphertext. ECB is also not a recommended mode for bulk data protection under current guidance, making it a poor choice despite its independent-block behavior.