hardMultiple ChoiceObjective-mapped
CISSP Practice Question: During a security audit of a financial…
During a security audit of a financial application, the auditor discovers that the application uses a custom encryption algorithm for storing sensitive data. The developer claims it is more efficient than AES. What should the auditor recommend?
⚠ Common exam trap
Many exam-takers think performing cryptanalysis (Option C) is a valid audit recommendation, but in practice, the auditor's role is to enforce the use of proven standards, not to validate unproven custom cryptography.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Migrate to a widely-accepted encryption standard such as AES
Custom encryption algorithms are highly risky because they have not undergone the extensive peer review and cryptanalysis that standards like AES have. Even if the developer claims better efficiency, the lack of proven security guarantees makes the application vulnerable to attacks. The correct recommendation is to migrate to a widely-accepted standard such as AES, which is FIPS 197 validated and trusted for protecting sensitive financial data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct additional penetration testing on the encryption implementation
Why it's wrong here
Penetration testing primarily identifies implementation vulnerabilities or configuration weaknesses within a system, not inherent cryptographic flaws in a custom algorithm's design. Custom algorithms lack the rigorous, global peer review essential for identifying subtle mathematical weaknesses that even extensive testing by a single team would likely miss, leaving critical vulnerabilities undiscovered. Therefore, additional testing cannot guarantee the fundamental security of an unproven algorithm.
- ✗
Accept the risk if the algorithm is more efficient
Why it's wrong here
Prioritizing marginal efficiency gains over proven cryptographic security is an unacceptable risk, especially for financial applications where data integrity and confidentiality are paramount. An unvetted, custom algorithm carries an unknown and potentially catastrophic risk of compromise, which far outweighs any minor performance benefits it might offer. The potential financial and reputational damage from a breach would severely impact the organization, making efficiency an insufficient justification for accepting such a risk.
- ✗
Perform a cryptoanalysis of the algorithm to validate its strength
Why it's wrong here
While performing a cryptoanalysis could identify specific weaknesses in the custom algorithm, this process is highly specialized and resource-intensive, providing only a snapshot of its security at a given time. Even if initial analysis finds no obvious flaws, a custom algorithm lacks the continuous, global scrutiny and diverse attack perspectives that widely-accepted standards receive over many years. This absence of extensive peer review means hidden vulnerabilities are much more likely to persist, making it inherently less trustworthy for production use.
- ✓
Migrate to a widely-accepted encryption standard such as AES
Why this is correct
Migrating to a widely-accepted encryption standard like AES is the most secure and responsible approach because these algorithms have undergone decades of extensive, global peer review by expert cryptographers. This rigorous scrutiny ensures that known vulnerabilities are identified and addressed, providing a high level of confidence in their mathematical strength and resilience against various attack vectors. Such standards are battle-tested and trusted, offering a robust foundation for protecting sensitive financial data, which is critical for financial applications.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.