SSCP Cryptography Practice Question
A security analyst is evaluating encryption modes for a new system that requires authenticated encryption to ensure both confidentiality and integrity of data in transit. Which AES mode should the analyst recommend?
⚠ Common exam trap
A common mix-up: candidates confuse confidentiality-only modes (like CBC or CTR) with authenticated encryption, overlooking that GCM is the only option listed that natively provides both encryption and integrity in a single mode.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GCM
GCM (Galois/Counter Mode) is the correct choice because it provides authenticated encryption, combining the confidentiality of CTR mode with integrity verification via a Galois field authentication tag. This makes it ideal for securing data in transit, as it ensures both privacy and tamper detection in a single, efficient operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ECB
Why it's wrong here
ECB encrypts identical plaintext blocks to identical ciphertext blocks, leaking patterns and providing no integrity protection. It is tempting for its simplicity and parallel processing, but it is unsuitable for any structured data; authenticated modes such as GCM are needed for confidentiality and integrity together.
- ✗
CBC
Why it's wrong here
CBC chains blocks for confidentiality but supplies no authentication tag, so modifications to ciphertext are not reliably detected. It is tempting as a long-established, widely supported mode, yet it must be paired with a separate MAC; authenticated modes such as GCM provide both properties natively.
- ✗
CTR
Why it's wrong here
CTR provides confidentiality only; it lacks a built-in authentication tag, so integrity is not verified and ciphertext tampering goes undetected. It is tempting because CTR is fast and parallelisable for bulk encryption, but authenticated modes such as GCM are required when integrity must be assured.
- ✓
GCM
Why this is correct
GCM combines AES counter-mode encryption with GHASH authentication, producing a tag that verifies integrity alongside confidentiality in a single pass. This satisfies the authenticated encryption requirement, unlike CBC or CTR, which provide confidentiality only and need a separate MAC.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is evaluating the cryptographic settings for a new application that requires both confidentiality and integrity for data in transit. The analyst needs to choose a symmetric cipher that provides authenticated encryption. Which of the following is the best choice?
medium- A.RC4 stream cipher
- B.AES in ECB mode
- ✓ C.AES in GCM mode
- D.AES in CBC mode
Why C: AES in GCM mode provides authenticated encryption, offering both confidentiality and integrity/authenticity in a single operation. GCM (Galois/Counter Mode) is an AEAD (Authenticated Encryption with Associated Data) mode, making it the best choice for data in transit requiring both properties.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.