easyMultiple Select
CISA Practice Question: Which THREE of the following are commonly used…
Which THREE of the following are commonly used data encryption standards? (Choose three.)
⚠ Common exam trap
Test-takers frequently confuse cryptographic hash functions (SHA-256, MD5) with encryption standards, leading candidates to select them as methods for protecting data confidentiality rather than integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
3DES
3DES (A) is a symmetric block cipher that applies the DES algorithm three times to each data block, making it a widely recognized data encryption standard. RSA (C) is an asymmetric encryption standard based on public/private key pairs, commonly used for encrypting data and exchanging keys. AES (D) is the modern symmetric block cipher standard adopted by NIST, widely used for data-at-rest and data-in-transit encryption. SHA-256 (B) and MD5 (E) are cryptographic hash functions used for integrity and message digests, not for encrypting data, so they do not belong among encryption standards.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
3DES
Why this is correct
3DES applies the DES cipher three times with two or three distinct keys, giving an effective strength of 112 or 168 bits. Although deprecated in favour of AES, it remains a widely recognised symmetric encryption standard and is therefore a valid selection here.
- ✗
SHA-256
Why it's wrong here
SHA-256 is a cryptographic hash producing a fixed-length digest for integrity and signatures, not a reversible encryption standard for confidentiality. It is tempting because it appears alongside encryption algorithms in TLS cipher suites, but hashing would be the correct selection only where data integrity, not encryption, is required.
- ✓
RSA
Why this is correct
RSA is an asymmetric algorithm whose security rests on the difficulty of factoring large integers. It is used for key transport and digital signatures rather than bulk data encryption, but it is unquestionably a commonly used encryption standard.
- ✓
AES
Why this is correct
AES is a symmetric block cipher standardised by NIST (FIPS 197), operating on 128-bit blocks with 128-, 192- or 256-bit keys. It is the de facto standard for data-at-rest and bulk encryption, satisfying the question's requirement for a commonly used encryption standard.
- ✗
MD5
Why it's wrong here
MD5 is a hash function producing a 128-bit digest for integrity checking, not a reversible encryption standard, so it cannot provide confidentiality. It would be the right answer if the question asked about message digests or checksums rather than encryption algorithms.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.