CSS CSS Cryptography & Data Protection 2

Question 1

What is the difference between data masking and data encryption?

Accepted Answer

Masking replaces data with fictitious values while encryption scrambles data reversibly with a key

Answer

Data masking permanently replaces sensitive data with realistic but fake values, while encryption scrambles data that can be restored with the correct key.

Question 2

Which key management practice ensures that encryption keys are protected from the data they encrypt?

Accepted Answer

Storing keys in a separate hardware security module (HSM)

Answer

An HSM is a dedicated hardware device that stores and processes cryptographic keys in a tamper-resistant environment, separate from the data.

Question 3

What does tokenization do to protect sensitive data such as payment card numbers?

Accepted Answer

Replaces sensitive data with a non-sensitive surrogate value that maps back to the original in a secure vault

Answer

Tokenization substitutes sensitive data with a random token; the original value is stored in a secure token vault and can only be retrieved by authorized systems.

Question 4

What is the main vulnerability addressed by salting a password hash?

Accepted Answer

Prevents rainbow table and precomputed hash lookup attacks

Answer

A salt is a random value added to a password before hashing, ensuring that identical passwords produce different hashes and defeating precomputed lookup tables.

Question 5

Which US regulatory framework mandates encryption of cardholder data at rest and in transit?

Accepted Answer

PCI DSS (Payment Card Industry Data Security Standard)

Answer

PCI DSS Requirement 3 mandates protection of stored cardholder data and Requirement 4 mandates encryption of cardholder data in transit.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS CSS Cryptography & Data Protection 2