[2026] Practice with these Introduction-to-Cryptography dumps Certification Sample Questions [Q45-Q61]

Rate this post

[2026] Practice with these Introduction-to-Cryptography dumps Certification Sample Questions

Get Instant Access of 100% REAL Introduction-to-Cryptography DUMP Pass Your Exam Easily

WGU Introduction-to-Cryptography Exam Syllabus Topics:

Section	Objectives
Topic 1: Applied Cryptography	– Cryptographic Best Practices – VPN Security – SSL/TLS Protocols – PGP and Email Encryption
Topic 2: Cryptanalysis and Attacks	– Social Engineering Prevention – Common Attack Vectors – Brute Force and Dictionary Attacks
Topic 3: Hashing and Digital Signatures	– Hash Functions (MD5, SHA-1, SHA-256) – Digital Signature Standards – Message Authentication Codes (MAC)
Topic 4: Symmetric Cryptography	– Key Management – Block Ciphers (AES, DES, 3DES) – Initialization Vectors (IV) – Stream Ciphers
Topic 5: Cryptography Fundamentals	– Symmetric vs Asymmetric Encryption – Cryptographic Terminology – History and Evolution of Cryptography
Topic 6: Asymmetric Cryptography	– Elliptic Curve Cryptography (ECC) – RSA Algorithm – Diffie-Hellman Key Exchange – Public Key Infrastructure (PKI)

NEW QUESTION 45
(What is a characteristic of Cipher Block Chaining (CBC) mode in cryptography?)

It encrypts each block of plaintext dependent on the previous block.

It generates a continuous stream of key material.

It requires a different key for each encryption operation.

It operates on 32-bit blocks.

CBC mode introduces chaining between blocks to prevent the pattern leakage inherent in ECB. In CBC, each plaintext block is XORed with the previous ciphertext block before being encrypted with the block cipher. For the first block, CBC uses an Initialization Vector (IV) to serve as the “previous ciphertext” input. This makes encryption of each block dependent on the previous block’s ciphertext, which is exactly the defining characteristic described in option A. CBC does not generate a continuous stream of key material-that describes stream ciphers or stream-like modes such as CTR/OFB. CBC also does not require a different key per operation; the same symmetric key is reused, while the IV must be fresh/unpredictable to ensure semantic security. The block size is determined by the underlying block cipher (e.g., AES is 128-bit blocks, DES/3DES are 64-bit blocks), not a fixed 32-bit size for CBC itself. Because CBC is not inherently authenticated, best practice is to pair it with a MAC (Encrypt-then-MAC) or use an AEAD mode instead.

NEW QUESTION 46
(Which type of exploit involves looking for different inputs that generate the same hash?)

Birthday attack

Linear cryptanalysis

Algebraic attack

Differential cryptanalysis

A birthday attack targets hash functions by exploiting the birthday paradox: collisions (two different inputs producing the same hash output) can be found much faster than brute-forcing a specific preimage. For an n-bit hash, the expected work t o find any collision is on the order of 2^(n/2), not 2^n. The attack is relevant because many security constructions rely on collision resistance-digital signatures, certificate fingerprints, integrity checks, and some commitment schemes. If an attacker ca n generate two different documents with the same hash, they may trick a signer into signing one version while later presenting the other as “signed,” depending on the protocol. Linear cryptanalysis and differential cryptanalysis are primarily techniques ag ainst block ciphers, analyzing relationships between plaintext/ciphertext differences or linear approximations across rounds. Algebraic attacks treat the cipher as a system of equations. The description “looking for different inputs that generate the same hash” is the hallmark of collision-finding, and the classic framing for that is the birthday attack.

NEW QUESTION 47
(How are limits managed for the number of bitcoins that can be created and stored in a blockchain?)

Rewards for mining reduce over time

The total number of participants has been set

A maximum has been established per country

Each person has a maximum number

Bitcoin’s supply is controlled by protocol rules enforced by consensus: new bitcoins enter circulation through the block subsidy awarded to miners for producing valid blocks. This subsidy is programmed to halve at fixed intervals (every 210,000 blocks), which steadily reduces the rate of new coin creation over time and asymptotically approaches a capped total supply (commonly cited as 21 million BTC).
This mechanism is often called the halving schedule and is the primary way limits are managed. The number of participants is not fixed; anyone can run a node or mine. There is no per-country cap and no per-person maximum enforced by the protocol-addresses and ownership are not limited that way. The supply cap emerges from the decreasing issuance schedule combined with consensus validation rules that reject blocks creating coins beyond what the schedule allows. Therefore, the correct answer is that limits are managed because rewards for mining reduce over time.

NEW QUESTION 48
(Employee A needs to send Employee B a symmetric key for confidential communication. Which key is used to encrypt the symmetric key?)

Employee A’s private key

Employee B’s public key

Employee A’s public key

Employee B’s private key

When securely distributing a symmetric key over an untrusted network, a common approach is hybrid cryptography: use asymmetric cryptography to protect the symmetric key, then use the symmetric key for bulk encryption. To ensure only Employee B can recover the symmetric key, Employee A encrypts (wraps) that symmetric key using Employee B’s public key. Because only Employee B should possess the matching private key, only B can decrypt the wrapped symmetric key. This is the same principle used in TLS key exchange (in older RSA key transport) and in secure email: encrypt the session key to the recipient’s public key. Encrypting the symmetric key with Employee A’s private key would not provide confidentiality-anyone with A’s public key could reverse it, and it functions more like a signature than encryption. Employee B’s private key should never be shared and is used only by B to decrypt. Therefore, for confidentiality of the shared symmetric key, the correct encryption key is Employee B’s public key.

NEW QUESTION 49
(What is used to randomize the initial value when generating Initialization Vectors (IVs)?)

Key

Plaintext

Algorithm

Nonce

An IV (Initialization Vector) is a value used to ensure that encrypting identical plaintext under the same key produces different ciphertexts, preventing pattern leakage. In many secure designs, the IV must be unique (and often unpredictable) per encryption operation. A common way to ensure uniqueness is to incorporate a nonce-a “number used once.” A nonce can be random, pseudo-random, or a counter-based value depending on the mode and security requirements. For example, CTR mode uses a nonce combined with a counter to produce unique input blocks; GCM uses a nonce/IV to ensure unique authentication and encryption behavior. The encryption key should remain stable across many operations and should not be used as the “randomizer” for IV generation; mixing key material into IV creation in an ad hoc way can create reuse or correlation issues. Plaintext and algorithm do not provide the needed uniqueness property. The nonce concept is specifically about ensuring one-time uniqueness of the starting value so that IV reuse does not repeat keystream blocks (stream modes) or reveal plaintext equality (CBC/CTR). Therefore, the correct choice is Nonce.

NEW QUESTION 50
(What is a component of a one-time password (OTP) that is needed to guess future iterations of passwords?)

Function

Initialization vector

Encryption algorithm

Seed

OTP systems (such as HOTP and TOTP) generate a sequence of passwords using a shared secret and a moving factor (counter or time). The critical secret that underpins the ability to compute past or future OTP values is the seed (also called the shared secret key). In HOTP, the seed is used with an HMAC function and an incrementing counter; in TOTP, the seed is used with HMAC and a time-step value. If an attacker obtains the seed and knows the algorithm and moving factor, they can compute future OTPs. The “function” and
“encryption algorithm” are typically standardized and public; security relies on keeping the seed secret. An initialization vector is not a standard OTP component in HOTP/TOTP generation. Therefore, the component needed to predict future OTP values is the seed. Protecting the seed is essential: it should be stored securely (e.
g., hardware token secure storage) and transmitted only through controlled provisioning processes. If compromised, OTP becomes predictable and no longer serves as a strong second factor.

NEW QUESTION 51
(What is the primary purpose of the Health Insurance Portability and Accountability Act (HIPAA) in relation to encryption?)

To standardize the use of encryption across all industries

To prohibit the use of electronic health records

To allow healthcare providers to encrypt patient records at their discretion

To ensure the confidentiality of patient information through secure measures like encryption

HIPAA is a U.S. regulation focused on protecting the privacy and security of protected health information (PHI). In relation to encryption, HIPAA’s Security Rule requires covered entities and business associates to implement appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI. Encryption is widely recognized as a key technical safeguard for confidentiality-protecting PHI in transit (e.g., over networks) and at rest (e.g., on storage devices) by making data unreadable without the proper keys. HIPAA does not standardize encryption across all industries, nor does it prohibit electronic health records; it regulates how they must be protected. While HIPAA often uses the term “addressable” for encryption controls (meaning organizations must implement it if reasonable and appropriate, or document an equivalent alternative), the overarching purpose remains protection of patient information through secure measures, with encryption as a central mechanism. Therefore, the best answer is ensuring confidentiality of patient information through secure measures like encryption.

NEW QUESTION 52
(Which number of bits gets encrypted each time encryption is applied during stream encryption?)

192

256

In the classical definition, a stream cipher encrypts data in very small units-often described as one bit at a time-by combining plaintext with a keystream (commonly via XOR). While many practical stream ciphers operate on bytes or words for efficiency, the conceptual distinction compared to block ciphers is that stream encryption processes data as a continuous stream rather than fixed-size blocks. This is why the standard teaching answer is “1 bit” per application of the keystream. Block ciphers, by contrast, encrypt blocks like 64 bits (DES/3DES) or 128 bits (AES) in each invocation of the block primitive. Options like 40, 192, and 256 are not typical stream cipher “per-step” processing sizes; 40 and 256 are often associated with key sizes, and
192 could be a key size for AES, not an encryption granularity. The essential security requirement for stream ciphers is that the keystream must be unpredictable and never reused with the same key/nonce combination; otherwise XOR properties allow attackers to recover relationships between plaintexts. Thus, the best answer is
1.

NEW QUESTION 53
(What is the relationship between Secure Sockets Layer (SSL) and Transport Layer Security (TLS)?)

SSL is the replacement of TLS.

SSL and TLS are identical in function and security.

SSL is only used in email encryption.

TLS replaced SSL to provide improved security.

TLS is the modern successor to SSL. SSL (notably SSL 2.0 and SSL 3.0) was an early protocol family for securing network communications, providing encryption, integrity, and endpoint authentication for applications like HTTPS. Over time, weaknesses were discovered in SSL’s design and in the cryptographic mechanisms commonly used with it. TLS was introduced as an improved, standardized evolution (starting with TLS 1.0, based on SSL 3.0 but with important fixes), and later versions (TLS 1.2 and TLS 1.3) significantly strengthened security by removing weak ciphers, improving key exchange, and tightening handshake and record protections. In practice, when people say “SSL” today, they often mean “TLS,” but true SSL is deprecated and should not be used. SSL is not a replacement of TLS, and the two are not identical in security-TLS versions incorporate substantial improvements and modern cryptographic best practices. SSL is also not limited to email; it was widely used for web traffic and other protocols. Therefore, the correct relationship is that TLS replaced SSL to provide improved security.

NEW QUESTION 54
(What is the value of 23 mod 6?)

The expression 23 mod 6 asks for the remainder when 23 is divided by 6. Modular arithmetic is foundational in cryptography, especially in public-key systems (RSA, Diffie-Hellman, ECC) where operations occur in finite rings or fields. To compute 23 mod 6, identify the largest multiple of 6 that does not exceed 23.
Multiples of 6 are 6, 12, 18, 24. Since 24 is greater than 23, the largest valid multiple is 18. Subtract: 23 # 18
= 5, so the remainder is 5. Therefore, 23 mod 6 = 5, which corresponds to option “05.” Modular reduction keeps numbers within a fixed range (0 to modulus#1), enabling stable arithmetic under wraparound behavior.
In cryptographic protocols, this wraparound property is essential for defining groups and ensuring operations remain bounded and consistent.

NEW QUESTION 55
(What describes how Counter (CTR) mode encryption functions?)

Converts the block cipher into a stream cipher, then uses a counter value and a nonce to encrypt the data

Uses a self-synchronizing stream cipher where the IV is encrypted and XORed with the data stream one bit at a time

Encrypts each block with the same key, where each block is independent of the others

Uses an IV to encrypt the first block, then uses the result of the encryption to encrypt the next block

CTR mode turns a block cipher (like AES) into a stream-like construction by generating a keystream from successive encryptions of a changing input block. Specifically, CTR forms input blocks using a nonce (unique per message) combined with an increasing counter. Each nonce||counter block is encrypted with the block cipher under the shared key, producing a pseudorandom output block. That output is then XORed with plaintext to yield ciphertext (and XORed with ciphertext to recover plaintext). This design enables parallelization (blocks can be generated independently), efficient random access decryption, and avoids chaining dependencies seen in modes like CBC. Option B describes CFB-like behavior; option C describes ECB; option D describes CBC. CTR’s security critically depends on never reusing the same nonce/counter sequence with the same key, because reuse would repeat keystream blocks and expose plaintext relationships. Therefore, the correct description is that CTR converts the block cipher into a stream cipher using a counter value and a nonce.

NEW QUESTION 56
(What does nonrepudiation aim to achieve in the context of cryptography?)

Verifying the identity of the sender in secure communication

Holding parties accountable for their actions and transactions

Ensuring the confidentiality of encrypted messages

Preventing unauthorized access to sensitive data

Nonrepudiation aims to prevent a party from later denying having performed an action, such as sending a message, approving a transaction, or signing a document. In cryptographic systems, nonrepudiation is typically supported by digital signatures, audit logs, and trusted time-stamping: if a message is signed with a private key and verified with the corresponding public key (often bound to an identity via a certificate), the signer can be held accountable for that signed content. This creates evidence that can be used for dispute resolution, compliance, and legal or contractual enforcement. Nonrepudiation is distinct from confidentiality (keeping data secret) and from access control (preventing unauthorized use). While authentication (verifying identity) is related and often a prerequisite, the defining goal is accountability-ensuring that actions can be attributed to entities in a way that is difficult to dispute later. Effective nonrepudiation also depends on secure private key management, certificate validation, and procedures that show the key was under the signer’s control at the time. Therefore, the correct answer is holding parties accountable for their actions and transactions.

NEW QUESTION 57
(Why is it important for cryptography frameworks to adapt over time?)

To respond to emerging security threats and vulnerabilities

To maintain a rigid structure for data protection

To standardize the use of obsolete encryption techniques

To comply with outdated technology standards

Cryptography must evolve because threats, computing capabilities, and attack techniques continuously change. Algorithms once considered safe can become vulnerable due to cryptanalysis, implementation attacks, protocol flaws, or sheer increases in available compute power. Examples include the deprecation of SHA-1 for signatures, weakening of RC4, and migration away from older TLS versions and weak cipher suites. Frameworks also need to adapt to new environments-cloud architectures, IoT deployments, mobile devices-and new adversary models, including the long-term risk posed by quantum computing to current public-key systems. Adaptation includes updating standards, increasing key sizes where needed, adopting modern primitives (AEAD modes, stronger KDFs), improving key management practices (rotation, hardware- backed storage), and refining operational guidance (certificate lifetimes, revocation strategies). A rigid structure that never changes would lock organizations into obsolete protections and accumulate risk.
Standardizing obsolete techniques or complying with outdated standards is the opposite of sound security engineering. Therefore, cryptography frameworks must adapt over time to respond to emerging threats and vulnerabilities and to maintain effective protection as the landscape evolves.

NEW QUESTION 58
(Why did the National Institute of Standards and Technology (NIST) choose Ascon for lightweight cryptography?)

To authenticate users during data transmission

To ensure compatibility with legacy systems

To provide a secure and efficient encryption solution for resource-constrained devices

To encrypt data at rest

NIST’s lightweight cryptography effort targets environments like IoT and embedded systems where CPU, memory, energy, and bandwidth are constrained, yet strong security is still required. Ascon is an authenticated encryption with associated data (AEAD) family designed to be efficient in both hardware and software with small footprint, making it well-suited for constrained devices. NIST selected Ascon because it offers a strong security design with good performance and implementability under tight resource budgets, while providing modern protections (confidentiality + integrity) through AEAD. That aligns with option C: secure and efficient encryption for resource-constrained devices. The selection was not primarily about authenticating users (that is typically handled by protocols and identity systems, not an AEAD primitive). It was also not mainly about legacy compatibility; lightweight cryptography aims at new and constrained deployments rather than preserving outdated stacks. And while Ascon can certainly be used to protect data at rest, that is only one application; the core reason for the choice is its suitability for constrained environments and robust, efficient authenticated encryption.

NEW QUESTION 59
(A company wants to use certificates issued by a root CA to demonstrate to customers that it is a legitimate company being hosted by a cloud provider. Who needs to trust the root CA public key?)

The seller and the buyer

The cloud provider and the seller

The Federal Trade Commission and the cloud provider

The buyer and the Federal Trade Commission

In a public key infrastructure, trust in a certificate ultimately depends on the relying party’s trust anchor set-typically the root CA certificates preinstalled in a customer’s browser/OS trust store. For customers to accept the company’s certificate as legitimate, the buyer (customer) must trust the root CA public key (or an intermediate chained to it) so they can validate the certificate chain and signatures. The seller (the company) also must trust and rely on the root CA public key to build and present a valid chain and to make operational decisions based on that CA’s issuance and revocation mechanisms; practically, the seller selects a CA whose root is widely trusted by customers. The cloud provider’s trust is not what makes the certificate valid to customers; the provider may terminate TLS or pass traffic through, but customer validation is based on the chain to a trusted root. Government agencies like the FTC are not part of the cryptographic trust path for TLS certificate validation.
Therefore, among the given options, the correct pairing is the seller and the buyer, reflecting both the issuer selection/usage by the company and the relying-party validation by customers.

NEW QUESTION 60
(What type of encryption uses different keys to encrypt and decrypt the message?)

Symmetric

Private key

Secure

Asymmetric

Asymmetric encryption (also called public key cryptography) uses a pair of mathematically related keys: a public key and a private key. One key is used to encrypt, and the other is used to decrypt, which is the defining “different keys” property asked in the question. In the common confidentiality use case, a sender encrypts a message using the recipient’s public key, and only the recipient can decrypt it using their private key. This solves the key distribution problem inherent in symmetric encryption, where both parties must securely share the same secret key in advance. Asymmetric systems also enable digital signatures: the private key signs (creates a signature) and the public key verifies it, providing authenticity and integrity. Symmetric encryption, by contrast, uses the same shared key for both encryption and decryption (even though internal round keys may exist, it is still one shared secret). “Private key” alone is not a full encryption type, and
“secure” is a generic description rather than a cryptographic category. Therefore, the correct answer is D.
Asymmetric.

NEW QUESTION 61
(Which number generator has different results given the same input data?)

Prime

Sequence

Pseudorandom

True random

A true random number generator (TRNG) produces outputs derived from nondeterministic physical processes (e.g., thermal noise, oscillator jitter, radioactive decay, or other hardware entropy sources). Because the underlying phenomenon is not algorithmically determined by an input seed in the same way as a PRNG, repeated “inputs” (or identical conditions from a software perspective) do not yield the same sequence; the outputs vary unpredictably. By contrast, a pseudorandom number generator (PRNG) is deterministic: given the same seed and internal state, it produces the same output sequence, which is useful for repeatability but means security depends on seed secrecy and proper seeding. “Prime” is not a generator type, and “sequence” is too generic and does not imply nondeterminism. In cryptographic systems, TRNGs (or hardware entropy sources) are often used to seed cryptographically secure PRNGs (CSPRNGs), combining high-quality entropy with efficient generation. Therefore, the generator that can produce different results for the “same input data” is a true random number generator.

Loading …