SSCP Cryptography Practice Question
A financial institution is implementing a digital signature solution to ensure the integrity and authenticity of wire transfer instructions. The solution must provide non-repudiation and use a NIST-approved algorithm. Which of the following should the security architect select?
⚠ Common exam trap
Many exam-takers confuse message authentication codes or symmetric encryption with digital signatures, which are the only cryptographic mechanisms that provide non-repudiation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ECDSA with SHA-256
ECDSA with SHA-256 is a NIST-approved digital signature algorithm that provides non-repudiation, integrity, and authenticity. It is based on elliptic curve cryptography, which is efficient and secure with smaller key sizes. The other options either lack non-repudiation (HMAC, AES-GCM) or use deprecated algorithms (RSA-1024 with SHA-1).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HMAC-SHA256
Why it's wrong here
HMAC-SHA256 is a message authentication code that provides integrity and authenticity but not non-repudiation, because it uses a shared secret key. Both parties can generate the same MAC, so neither can prove to a third party who created the message. It does not meet the non-repudiation requirement for wire transfers.
- ✗
AES-256-GCM
Why it's wrong here
AES-256-GCM is a symmetric authenticated encryption algorithm that provides confidentiality and integrity, but it does not provide digital signatures or non-repudiation. It uses a shared key, so any party with the key could have generated the ciphertext. It is not a digital signature algorithm and fails the non-repudiation requirement.
- ✓
ECDSA with SHA-256
Why this is correct
ECDSA (Elliptic Curve Digital Signature Algorithm) with SHA-256 is a NIST-approved digital signature algorithm (FIPS 186-4) that provides integrity, authenticity, and non-repudiation. It uses elliptic curve cryptography, which offers strong security with smaller key sizes compared to RSA. This meets the financial institution's requirements for a NIST-approved algorithm.
- ✗
RSA-1024 with SHA-1
Why it's wrong here
RSA-1024 with SHA-1 is deprecated and not NIST-approved for digital signatures. SHA-1 is considered cryptographically broken due to collision attacks, and RSA-1024 provides insufficient security strength. NIST SP 800-131A disallows SHA-1 for digital signature generation and recommends at least RSA-2048 or ECDSA with stronger hashes.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.