Cryptography PBQs test your ability to select appropriate encryption algorithms, configure key lengths, and implement cryptographic solutions for specific use cases. This guide teaches you how to match cryptographic tools to security requirements.
Interactive simulation — no account required
Cryptography PBQs present you with a security scenario and ask you to select or configure the appropriate cryptographic solution. You'll need to choose between symmetric and asymmetric encryption, select algorithm types, specify key lengths, and match cryptographic tools to use cases.
These questions test whether you understand when to use different cryptographic approaches. You might be asked to:
Symmetric encryption (AES) is fast and used for bulk data. Asymmetric encryption (RSA, ECC) is slow but solves key exchange. Hashing (SHA-256) provides integrity but isn't reversible. The exam tests your ability to select the right tool for each scenario.
When selecting cryptographic solutions, work through these decisions:
Match these algorithms to their appropriate scenarios:
Fast bulk encryption. Use for files, databases, disk encryption, VPN tunnels.
Key sizes: 128, 192, or 256 bits. AES-256 for sensitive data.Key exchange, digital signatures, encrypting small data. Slower than symmetric.
Key sizes: 2048 bits minimum, 4096 for high security.Same uses as RSA but with smaller keys for equivalent security. Better for mobile/IoT.
P-256 curve ≈ RSA-3072. P-384 for higher security.Integrity verification, digital signatures, password hashing (with salt/stretching).
SHA-256 is standard. SHA-1 is deprecated. MD5 is broken.A company needs to protect data in three scenarios. Here's how to select the right cryptographic approach for each:
Encrypt customer database stored on servers
Fast symmetric encryption for large data volumes with hardware-protected keys
Secure file transfer between office locations
Asymmetric for secure key exchange, symmetric for fast bulk encryption
Verify downloaded software hasn't been modified
Hash detects tampering, signature proves publisher identity
Scenario 1 - Data at Rest: AES-256 is the standard for encrypting stored data. It's fast enough to encrypt entire databases without significant performance impact. The key must be stored securely, ideally in a Hardware Security Module (HSM).
Scenario 2 - Data in Transit: TLS combines multiple cryptographic primitives. ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) exchanges keys securely without transmitting them. AES-GCM provides authenticated encryption for the actual data.
Scenario 3 - Integrity + Authenticity: A hash alone proves the file hasn't changed, but anyone can compute a hash. A digital signature proves the file came from the legitimate publisher and hasn't been modified. You need both.
Match algorithms to scenarios in interactive configurations.
Understanding when to use symmetric versus asymmetric encryption is fundamental to these PBQs:
Symmetric Encryption (AES, ChaCha20): - Same key encrypts and decrypts - Very fast, suitable for large data volumes - Problem: How do you securely share the key? - Use for: File encryption, database encryption, VPN data channels
Asymmetric Encryption (RSA, ECC): - Public key encrypts, private key decrypts (or vice versa for signatures) - Much slower than symmetric - Solves key exchange problem - Use for: Key exchange, digital signatures, encrypting small data (like symmetric keys)
Hybrid Approach (TLS, PGP): - Use asymmetric to exchange a symmetric key - Use symmetric for bulk data encryption - Gets the best of both: secure key exchange + fast encryption
These are always wrong answers on the exam for new deployments:
Encryption is only as secure as your key management:
Key Generation — Use cryptographically secure random number generators. Never use predictable sources.
Key Storage — Private keys and symmetric keys must be protected. HSMs provide hardware-based security. Key management services (KMS) handle this in cloud environments.
Key Rotation — Regularly change keys to limit the impact of potential compromise. Automated rotation reduces operational risk.
Key Escrow — Storing copies of keys with a trusted third party. Necessary for compliance but creates risk. Balance availability against security.
Key Destruction — When keys expire or systems are decommissioned, keys must be securely destroyed. Improper destruction leaves data vulnerable.
A cryptography PBQ asks you to select or configure cryptographic solutions for specific scenarios. You might choose between symmetric and asymmetric encryption, select appropriate algorithms and key lengths, or identify deprecated cryptographic configurations that need updating.
Encryption is reversible—you can decrypt ciphertext back to plaintext with the correct key. Hashing is one-way—you cannot recover the original data from a hash. Use encryption when you need to retrieve the original data. Use hashing for integrity verification and password storage where you only need to compare, not retrieve.
Use AES (symmetric) for encrypting large amounts of data—it's fast and efficient. Use RSA (asymmetric) for key exchange, digital signatures, and encrypting small data like symmetric keys. In practice, systems often use RSA to exchange an AES key, then AES for bulk encryption.
For AES: 256-bit for sensitive data, 128-bit minimum. For RSA: 2048-bit minimum, 4096-bit for high security or long-term protection. For ECC: P-256 curve minimum, P-384 for higher security. For hashing: SHA-256 or SHA-384. These provide adequate security through at least 2030.
Apply these concepts with an interactive Cryptography simulation.