SSCP Cryptography Practice Question
A healthcare provider must protect the confidentiality of patient records stored on a shared network drive. The compliance officer mandates that the encryption solution use a symmetric algorithm with a 256-bit key and operate as a block cipher. Which of the following should the security administrator select to meet these requirements?
⚠ Common exam trap
Watch out — candidates often confuse hash functions such as SHA-256 with encryption algorithms, or assuming any symmetric cipher like 3DES meets a 256-bit key requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AES-256
AES-256 is the correct choice because it is a symmetric block cipher with a 256-bit key, exactly matching the compliance requirement. RSA is asymmetric and too slow for bulk data, 3DES lacks the required key size and is deprecated, and SHA-256 is a hash function that provides no confidentiality. Only AES-256 satisfies all stated conditions for protecting stored records.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AES-256
Why this is correct
AES-256 is a symmetric block cipher standardized by NIST with a 256-bit key and a 128-bit block size. It satisfies the requirement for strong symmetric encryption and is widely supported in both hardware and software for protecting data at rest, including patient records on shared storage.
- ✗
RSA-2048
Why it's wrong here
RSA-2048 is an asymmetric algorithm used primarily for key exchange and digital signatures, not for bulk data confidentiality. It uses a 2048-bit key pair and is much slower than symmetric ciphers for encrypting large volumes of patient records, so it does not meet the stated symmetric block cipher requirement.
- ✗
SHA-256
Why it's wrong here
SHA-256 is a cryptographic hash function, not an encryption algorithm. It produces a 256-bit digest for integrity and digital signatures but cannot provide confidentiality by encrypting patient records. Selecting it would fail the requirement for a symmetric block cipher with a 256-bit key.
- ✗
3DES
Why it's wrong here
3DES is a symmetric block cipher but has a 64-bit block size and an effective key strength of at most 112 or 168 bits depending on the keying option. It is deprecated by NIST for new applications and does not provide the mandated 256-bit key, making it unsuitable here.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.