CISSP Security Architecture and Engineering Practice Question
A security architect is selecting a cryptographic algorithm for encrypting data at rest in a backup system. The system requires strong security with a block cipher, and the organization mandates using a NIST-approved algorithm with key sizes of 128, 192, or 256 bits. Which algorithm should be selected?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AES
AES is a NIST-approved symmetric block cipher supporting 128, 192, and 256-bit keys. It is the standard for data at rest encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RC4
Why it's wrong here
RC4 is a stream cipher, meaning it encrypts data bit by bit or byte by byte, rather than in fixed-size blocks. While historically used for its speed, RC4 has known cryptographic vulnerabilities, including biases in its key stream and susceptibility to related-key attacks. These significant security flaws make it unsuitable for modern secure applications, leading to its deprecation in protocols like WEP and TLS.
- ✗
RSA
Why it's wrong here
RSA is an asymmetric cryptographic algorithm, utilizing a pair of mathematically linked public and private keys. Its primary applications include secure key exchange, digital signatures, and encrypting small amounts of data, such as symmetric keys. Due to its computational intensity, which involves complex mathematical operations on large prime numbers, RSA is prohibitively slow and inefficient for encrypting large volumes of "bulk data," making symmetric ciphers the preferred choice for such tasks.
- ✓
AES
Why this is correct
AES (Advanced Encryption Standard) is a symmetric block cipher, widely recognized and adopted as the global standard for secure data encryption. It operates by encrypting data in fixed-size blocks (128 bits) using key sizes of 128, 192, or 256 bits, offering robust security against all known practical attacks when properly implemented. Its excellent balance of strong cryptographic properties, high performance, and efficiency makes it the optimal choice for encrypting bulk data in contemporary systems.
- ✗
3DES
Why it's wrong here
Triple DES (3DES or TDES) is a symmetric block cipher that applies the original DES algorithm three times to each 64-bit data block, typically using two or three distinct keys to enhance security. While it provides a larger effective key length than single DES, its smaller 64-bit block size and inherent computational overhead make it significantly slower and less efficient than modern ciphers like AES. NIST officially deprecated 3DES in 2017, recommending a transition to AES due to its susceptibility to meet-in-the-middle attacks and performance limitations.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.