CSS CSS Cryptography & Data Protection 2 — Questions and Answers
Question 1: What is the difference between data masking and data encryption?
- Masking replaces data with fictitious values while encryption scrambles data reversibly with a key (Correct answer)
- Masking is stronger than encryption
- Encryption permanently destroys data
- Masking requires a decryption key to reverse
Correct answer: Masking replaces data with fictitious values while encryption scrambles data reversibly with a key
Data masking permanently replaces sensitive data with realistic but fake values, while encryption scrambles data that can be restored with the correct key.
Question 2: Which key management practice ensures that encryption keys are protected from the data they encrypt?
- Storing keys in a separate hardware security module (HSM) (Correct answer)
- Storing keys in the same database as encrypted data
- Encoding keys in application source code
- Sharing keys via unencrypted email
Correct answer: Storing keys in a separate hardware security module (HSM)
An HSM is a dedicated hardware device that stores and processes cryptographic keys in a tamper-resistant environment, separate from the data.
Question 3: What does tokenization do to protect sensitive data such as payment card numbers?
- Replaces sensitive data with a non-sensitive surrogate value that maps back to the original in a secure vault (Correct answer)
- Hashes the data irreversibly
- Encrypts data using AES-256
- Compresses data to reduce storage size
Correct answer: Replaces sensitive data with a non-sensitive surrogate value that maps back to the original in a secure vault
Tokenization substitutes sensitive data with a random token; the original value is stored in a secure token vault and can only be retrieved by authorized systems.
Question 4: What is the main vulnerability addressed by salting a password hash?
- Prevents rainbow table and precomputed hash lookup attacks (Correct answer)
- Prevents brute-force attacks entirely
- Speeds up authentication
- Replaces the need for password complexity requirements
Correct answer: Prevents rainbow table and precomputed hash lookup attacks
A salt is a random value added to a password before hashing, ensuring that identical passwords produce different hashes and defeating precomputed lookup tables.
Question 5: Which US regulatory framework mandates encryption of cardholder data at rest and in transit?
- PCI DSS (Payment Card Industry Data Security Standard) (Correct answer)
- HIPAA Security Rule
- SOX Section 404
- FISMA
Correct answer: PCI DSS (Payment Card Industry Data Security Standard)
PCI DSS Requirement 3 mandates protection of stored cardholder data and Requirement 4 mandates encryption of cardholder data in transit.
Question 6: What is end-to-end encryption (E2EE) designed to prevent?
- Interception and decryption of data by intermediaries, including service providers (Correct answer)
- Unauthorized physical access to devices
- SQL injection in database systems
- Privilege escalation on endpoints
Correct answer: Interception and decryption of data by intermediaries, including service providers
E2EE ensures that only the communicating endpoints can decrypt the data, preventing even the service provider from reading message content.
CSS CSS Cryptography & Data Protection 2
What is the difference between data masking and data encryption?