CSX CSX Cryptography and Data Protection 2 — Questions and Answers
Question 1: What is the purpose of key escrow in an enterprise data protection program?
- To speed up encryption operations
- To store copies of encryption keys with a trusted third party for recovery (Correct answer)
- To generate stronger encryption keys automatically
- To revoke compromised certificates immediately
Correct answer: To store copies of encryption keys with a trusted third party for recovery
Key escrow involves depositing encryption keys with a trusted authority to enable data recovery if keys are lost or personnel leave.
Question 2: Which concept ensures that a sender cannot deny having sent a message by using digital signatures?
- Confidentiality
- Integrity
- Non-repudiation (Correct answer)
- Availability
Correct answer: Non-repudiation
Non-repudiation, achieved through digital signatures, cryptographically binds the sender to a message, preventing denial.
Question 3: What is the main security risk associated with using outdated SSL 3.0 or TLS 1.0 protocols?
- They are incompatible with modern browsers
- They contain known vulnerabilities like POODLE and BEAST that allow traffic decryption (Correct answer)
- They do not support certificate validation
- They can only encrypt traffic under 1MB
Correct answer: They contain known vulnerabilities like POODLE and BEAST that allow traffic decryption
Older SSL/TLS versions have known cryptographic weaknesses exploited by attacks like POODLE and BEAST, enabling plaintext recovery.
Question 4: What does data masking accomplish in a data protection strategy?
- Encrypts data at rest using AES-256
- Replaces sensitive data with realistic but fictitious values for non-production use (Correct answer)
- Shreds deleted files to prevent recovery
- Hides network traffic using steganography
Correct answer: Replaces sensitive data with realistic but fictitious values for non-production use
Data masking substitutes real sensitive values with fictitious but structurally similar data, protecting privacy in testing environments.
Question 5: Which US federal law primarily governs the protection of health information and mandates security safeguards?
- FERPA
- GLBA
- HIPAA (Correct answer)
- COPPA
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) mandates administrative, physical, and technical safeguards for protected health information (PHI).
Question 6: What is the purpose of full-disk encryption (FDE) on endpoint devices?
- To speed up file access through compression
- To protect data confidentiality if a device is lost or stolen (Correct answer)
- To prevent malware from installing drivers
- To enforce user authentication policies remotely
Correct answer: To protect data confidentiality if a device is lost or stolen
Full-disk encryption ensures that all data on a device is unreadable without the correct credentials, protecting against physical theft.
CSX CSX Cryptography and Data Protection 2
What is the purpose of key escrow in an enterprise data protection program?