SSCP Cryptography Practice Question
A security engineer is deploying a new VPN concentrator that must use a symmetric encryption algorithm approved by NIST for protecting sensitive government data. The algorithm must operate as a block cipher with a 128-bit block size and support key sizes of 128, 192, and 256 bits. Which algorithm should the engineer select?
⚠ Common exam trap
The trap here is assuming that any well-known symmetric cipher is NIST-approved for government data, when only AES meets the block size and key length requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AES
AES is the only NIST-approved symmetric block cipher that meets all stated requirements: 128-bit block size and support for 128-, 192-, and 256-bit keys. It is widely implemented in VPN concentrators and is suitable for protecting sensitive government data. The other algorithms either have smaller block sizes, are asymmetric, or lack NIST approval for this use case.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RSA
Why it's wrong here
RSA is an asymmetric algorithm used for key exchange and digital signatures, not a symmetric block cipher. It operates on blocks smaller than the modulus size and is much slower than symmetric ciphers. It cannot serve as the bulk encryption algorithm for VPN traffic in this scenario.
- ✗
Blowfish
Why it's wrong here
Blowfish is a symmetric block cipher with a 64-bit block size and variable key length up to 448 bits. It is not approved by NIST for protecting sensitive government data, and its 64-bit block size makes it vulnerable to birthday attacks in high-volume traffic. It fails the NIST approval and block size requirements.
- ✓
AES
Why this is correct
AES is a symmetric block cipher standardized by NIST (FIPS 197) with a 128-bit block size and supported key sizes of 128, 192, and 256 bits. It is approved for protecting sensitive government data up to Top Secret when used with appropriate key lengths. This matches the engineer's requirements exactly.
- ✗
3DES
Why it's wrong here
3DES is a symmetric block cipher with a 64-bit block size and effective key strength of at most 112 bits. NIST has deprecated 3DES for most applications due to its small block size and limited security margin. It does not meet the requirement for a 128-bit block size or 256-bit key support.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.