mediumMultiple Choice
SSCP Practice Question: A security administrator needs to choose an…
A security administrator needs to choose an encryption algorithm for a high-speed network where data is encrypted at the link layer. Which algorithm is most appropriate?
⚠ Common exam trap
Watch out — candidates often confuse encryption algorithms with key exchange or hashing functions, mistakenly choosing RSA or Diffie-Hellman for bulk encryption, or SHA-256 for confidentiality, when symmetric ciphers like AES are the correct choice for high-speed link-layer encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AES
AES (Advanced Encryption Standard) is the most appropriate choice for link-layer encryption in high-speed networks because it is a symmetric block cipher designed for efficient hardware and software implementation, offering high throughput with low latency. Unlike asymmetric algorithms, AES operates with a single shared key, making it ideal for encrypting bulk data at the data link layer where speed and minimal overhead are critical.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RSA
Why it's wrong here
RSA's modular exponentiation is computationally heavy, so it cannot sustain the throughput a link-layer encryptor demands; symmetric ciphers handle bulk data. RSA is tempting because it is the standard for key transport and digital signatures, where its asymmetric property solves key distribution rather than bulk confidentiality.
- ✗
Diffie-Hellman
Why it's wrong here
Diffie-Hellman negotiates a shared secret over an untrusted channel; it performs no bulk encryption itself, so link-layer frames remain in plaintext. It is tempting because it establishes keys for secure sessions, but that role is key agreement, not the symmetric cipher that actually protects high-speed data.
- ✓
AES
Why this is correct
AES is a symmetric block cipher offering high throughput in hardware, making it suited to link-layer encryption where line-rate performance is required. Its low latency and efficiency satisfy the high-speed constraint, unlike asymmetric algorithms such as RSA, which are far slower and impractical for bulk data encryption.
- ✗
SHA-256
Why it's wrong here
SHA-256 is a hash, producing a fixed digest for integrity checking; it has no key and cannot encrypt or decrypt link-layer traffic. It is tempting because it appears in security architectures alongside encryption, but it belongs in HMACs and signature schemes, not in a confidentiality algorithm.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.