Security+ topic 1.3
Cryptography and PKI
Symmetric encryption, such as AES, uses one shared key and is fast, so it protects bulk data. Asymmetric encryption, such as RSA or ECC, uses a public key and a private key, which solves key sharing. Public key infrastructure (PKI) ties public keys to identities through certificates signed by a certificate authority, and certificates can be revoked through a CRL or checked with OCSP. Hashing turns data into a fixed-length value to check integrity; a salt makes identical passwords hash differently, and key stretching makes guessing slower. A digital signature is a hash signed with a private key. Obfuscation hides data instead: steganography, tokenization, and data masking. Keys are stored in a TPM, HSM, or secure enclave.
Cryptography and PKI vocabulary
- Symmetric encryption: Encryption that uses the same key to encrypt and decrypt.
- Asymmetric encryption: Encryption that uses a public key and a matching private key.
- Certificate authority (CA): A trusted organization that issues and signs digital certificates.
- Salt: A random value added to a password before hashing so identical passwords get different hashes.
- Digital signature: A hash signed with a private key that proves who sent data and that it was not changed.
- Hardware security module (HSM): A dedicated device that stores and uses cryptographic keys securely.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A company needs to encrypt a 2 TB database quickly. Which of the following is the best choice?
- (A) RSA
- (B) AES
- (C) SHA-256
- (D) MD5
Show answer
(B) AES Symmetric encryption such as AES is fast enough for bulk data. SHA-256 and MD5 are hashes, not encryption.
2. Which of the following best describes the role of a certificate authority?
- (A) It stores users' passwords
- (B) It issues and signs digital certificates that bind public keys to identities
- (C) It blocks malicious websites
- (D) It encrypts data at rest
Show answer
(B) It issues and signs digital certificates that bind public keys to identities A CA vouches for identities by signing certificates.
3. A web browser needs to check right now whether a server's certificate has been revoked. Which of the following should it use?
- (A) OCSP
- (B) A salt
- (C) A CSR
- (D) Key stretching
Show answer
(A) OCSP The Online Certificate Status Protocol checks a certificate's status in real time.
4. Two users chose the same password, but their stored password hashes are different. Which of the following explains this?
- (A) The passwords were encrypted with AES
- (B) A unique salt was added to each password before hashing
- (C) The hashes were tokenized
- (D) The passwords were stored in plaintext
Show answer
(B) A unique salt was added to each password before hashing A random salt per password makes identical passwords produce different hashes.
5. An administrator downloads a software installer and compares its SHA-256 value with the one on the vendor's website. What is the administrator checking?
- (A) Confidentiality
- (B) Integrity
- (C) Availability
- (D) Authorization
Show answer
(B) Integrity Matching hashes show the file was not changed.
6. A payment system replaces card numbers with random values that are useless if stolen and keeps the real numbers in a secure vault. Which of the following is this?
- (A) Steganography
- (B) Hashing
- (C) Tokenization
- (D) Key escrow
Show answer
(C) Tokenization Replacing sensitive data with a random token is tokenization.