Excellent Introduction-to-Cryptography Updated 2026 Dumps With 100% Exam Passing Guarantee
Best way to practice test for WGU Introduction-to-Cryptography
NEW QUESTION # 26
(Which additional input element can be used to implement integrity in combination with symmetric ciphers?)
- A. Initialization vector
- B. Encoding algorithm
- C. Nonce value
- D. Hash function
Answer: D
Explanation:
Symmetric encryption alone typically provides confidentiality, but it does not automatically provide integrity. Many encryption modes (especially older ones like CBC without authentication) are malleable, meaning an attacker may be able to modify ciphertext and cause predictable changes in plaintext after decryption. To add integrity, systems commonly combine symmetric encryption with a cryptographic hash-based integrity mechanism, such as a hash function used in an HMAC (Hash-based Message Authentication Code) or a dedicated authenticated-encryption mode like GCM that internally uses authentication tags. Among the given options, a hash function is the fundamental additional element that enables integrity checks: it allows construction of a MAC (e.g., HMAC-SHA-256) that the receiver verifies to detect any tampering. An initialization vector and a nonce value are used to ensure uniqueness and randomness properties for encryption but do not, by themselves, guarantee integrity.
An encoding algorithm changes representation, not security. Therefore, the correct additional input element for implementing integrity alongside symmetric encryption is a hash function, typically as part of an HMAC or similar MAC construction.
NEW QUESTION # 27
(Why should an asymmetric private key be used to encrypt the digest of an application?)
- A. An asymmetric private key signs files by signing (encrypting) the hash of a file so integrity and authenticity can be verified with the corresponding public key.
- B. An asymmetric private key encrypts a small amount of information, which is decrypted with the corresponding private key.
- C. An asymmetric private key encrypts and decrypts data in blocks of characters at a time with a complex algorithm.
- D. An asymmetric private key uses the same key to encrypt and decrypt large amounts of media, one bit at a time.
Answer: A
Explanation:
Digital signing of software typically works by hashing the application (or its manifest) and then using the publisher's private key to create a digital signature over that digest. The private key is used because it is secret and uniquely controlled by the publisher; only the publisher should be able to produce a valid signature. Verifiers (customers) use the publisher's public key to validate the signature and confirm that the digest matches the software they received. This yields two key properties: integrity (the software hasn't been altered; any modification changes the digest and breaks verification) and authenticity (the signature proves it came from the private-key holder). Option A incorrectly describes symmetric stream encryption. Option C incorrectly generalizes private-key behavior as "block encryption." Option D is wrong because verification uses the public key, not a private key; also,
"encrypting with private key" in this context is better understood as signing, not confidentiality encryption. Therefore, the correct rationale is that the asymmetric private key is used to sign the file's digest so the corresponding public key can verify integrity and authenticity.
NEW QUESTION # 28
(What is the correlation between the number of rounds and the key length used in the AES algorithm?)
- A. The number of rounds increases as the key length increases.
- B. The number of rounds decreases as the key length increases.
- C. The key length is the same regardless of the number of rounds.
- D. The number of rounds is the same regardless of the key length.
Answer: A
Explanation:
In AES, the number of rounds is explicitly tied to the key length. AES-128 uses 10 rounds, AES-192 uses 12 rounds, and AES-256 uses 14 rounds. The purpose of additional rounds is to increase diffusion and confusion, strengthening resistance against cryptanalysis as the key schedule and state transformations iterate more times. Although key length primarily affects brute-force resistance, AES's designers and standardization parameters link longer keys with more rounds to maintain security margins across variants, especially considering differences in the key schedule structure. Thus, as key length increases from 128 to 192 to 256 bits, the number of rounds increases correspondingly from 10 to
12 to 14. This relationship is fixed by the AES specification and does not vary dynamically at runtime.
Therefore, the correct correlation is that the number of rounds increases as the key length increases.
NEW QUESTION # 29
(What are the primary characteristics of Bitcoin proof of work?)
- A. Easy to produce and difficult to verify
- B. Difficult to produce and difficult to verify
- C. Easy to produce and easy to verify
- D. Difficult to produce and easy to verify
Answer: D
Explanation:
Bitcoin's proof of work (PoW) is designed so that finding a valid block is computationally difficult, but checking validity is computationally easy. Miners must repeatedly hash candidate block headers (double SHA-256) with different nonces until they find a hash value below a network-defined target.
This trial-and-error search requires significant work and energy because the probability of success per attempt is extremely low at current difficulty levels. However, verification is straightforward: any node can hash the block header once (or a small number of times) and confirm the resulting hash meets the target threshold and that the block contents follow protocol rules. This "hard to produce, easy to verify" property is essential: it makes it expensive for attackers to rewrite history or outpace honest miners, while allowing all participants-even low-power devices-to validate blocks efficiently.
Therefore, the primary characteristic of Bitcoin proof of work is that it is difficult to produce and easy to verify.
NEW QUESTION # 30
(Two people want to communicate through secure email. The person creating the email wants to ensure only their friend can decrypt the email. Which key should the person creating the email use to encrypt the message?)
- A. Recipient's public key
- B. Recipient's private key
- C. Sender's public key
- D. Sender's private key
Answer: A
Explanation:
To ensure confidentiality so that only the intended recipient can decrypt an email, the sender must encrypt in a way that only the recipient can reverse. In public key cryptography, that means encrypting with the recipient's public key. The recipient is the only party who should possess the matching private key, so only they can decrypt the ciphertext. This pattern is fundamental to PKI-based secure email systems such as S/MIME and OpenPGP: the sender looks up or is provided the recipient's certificate
/public key, encrypts the message (often by encrypting a randomly generated symmetric session key with the recipient's public key), and the recipient uses their private key to recover the session key and decrypt the content. Encrypting with the sender's private key would not provide confidentiality; it resembles signing because anyone with the sender's public key could "decrypt" it. Encrypting with a private key of the recipient is also incorrect because private keys are not shared and should never leave the recipient's control. Therefore, the correct key to encrypt the message so only the friend can decrypt it is the recipient's public key.
NEW QUESTION # 31
(What describes how Counter (CTR) mode encryption functions?)
- A. Encrypts each block with the same key, where each block is independent of the others
- B. Converts the block cipher into a stream cipher, then uses a counter value and a nonce to encrypt the data
- C. Uses a self-synchronizing stream cipher where the IV is encrypted and XORed with the data stream one bit at a time
- D. Uses an IV to encrypt the first block, then uses the result of the encryption to encrypt the next block
Answer: B
Explanation:
CTR mode turns a block cipher (like AES) into a stream-like construction by generating a keystream from successive encryptions of a changing input block. Specifically, CTR forms input blocks using a nonce (unique per message) combined with an increasing counter. Each nonce||counter block is encrypted with the block cipher under the shared key, producing a pseudorandom output block. That output is then XORed with plaintext to yield ciphertext (and XORed with ciphertext to recover plaintext). This design enables parallelization (blocks can be generated independently), efficient random access decryption, and avoids chaining dependencies seen in modes like CBC. Option B describes CFB-like behavior; option C describes ECB; option D describes CBC. CTR's security critically depends on never reusing the same nonce/counter sequence with the same key, because reuse would repeat keystream blocks and expose plaintext relationships. Therefore, the correct description is that CTR converts the block cipher into a stream cipher using a counter value and a nonce.
NEW QUESTION # 32
(A security engineer is implementing device authentication as a form of two-factor authentication in a Public Key Infrastructure (PKI) environment. What should be used as a second form of authentication?)
- A. Symmetric encryption
- B. Asymmetric encryption
- C. Digital signature
- D. Digital certificate
Answer: D
Explanation:
In a PKI environment, a digital certificate is the standard credential used to bind an identity (user, device, service) to a public key, with that binding vouched for by a Certificate Authority. For device authentication, the device typically proves possession of the private key corresponding to the certificate' s public key (for example, during a TLS handshake). As a second factor in a two-factor model, a certificate (often stored in a TPM, smart card, or secure enclave) represents "something you have"-a cryptographic credential anchored to hardware or a managed endpoint. The other listed options (symmetric encryption, asymmetric encryption, digital signature) are cryptographic operations or algorithm classes, not stand-alone authentication factors. A digital signature is a mechanism used within authentication flows, but it is not itself the credential that establishes an enrolled device identity within PKI. In practice, a certificate-based device factor is commonly paired with a knowledge factor (password/PIN) or a biometric factor to achieve true 2FA, but among these choices, the appropriate second form of authentication in PKI terms is the digital certificate.
NEW QUESTION # 33
(Which type of network were VPN connections originally designed to tunnel through?)
- A. Private
- B. Public
- C. Encrypted
- D. Protected
Answer: B
Explanation:
A VPN (Virtual Private Network) is designed to create a secure, private communication channel over an otherwise untrusted or shared infrastructure. Historically and conceptually, VPNs were built to allow organizations and users to transmit sensitive traffic across the public Internet while maintaining confidentiality, integrity, and authenticity. The "virtual" aspect means the network behaves like a private link, but the underlying transport is typically a public network where attackers could potentially observe or tamper with traffic. VPN technologies such as IPsec and SSL/TLS-based VPNs encapsulate packets and apply encryption and authentication so that the payload and session metadata are protected even when traversing public routing domains. Options like "encrypted" and "protected" describe properties of the VPN tunnel itself rather than the underlying network it traverses; the VPN provides encryption/protection precisely because the medium is not inherently secure. "Private" would describe a dedicated internal network, which generally does not require a VPN to achieve basic confidentiality. Therefore, VPNs were originally designed to tunnel through public networks.
NEW QUESTION # 34
(What makes the RC4 cipher unique compared to RC5 and RC6?)
- A. Block
- B. Stream
- C. Symmetric
- D. Asymmetric
Answer: B
Explanation:
RC4 is unique among the RC family listed because it is a stream cipher. It generates a pseudorandom keystream and encrypts data by XORing that keystream with plaintext bytes (and decryption is the same XOR operation). This differs from RC5 and RC6, which are block ciphers: they encrypt fixed-size blocks of data through multiple rounds of operations (such as modular addition, XOR, and rotations) using a secret key. The stream-cipher design means RC4 historically fit protocols where data arrives continuously (e.g., early wireless and web encryption) and where simple, fast software implementation was desired. However, stream ciphers demand careful handling of nonces/IVs to avoid keystream reuse; reuse can catastrophically leak plaintext relationships. RC4 also has well-documented statistical biases in its keystream, leading to practical attacks in protocols like WEP and later concerns in TLS, which is why RC4 has been deprecated in modern security standards. Still, from a classification standpoint, "stream" is the distinguishing characteristic versus RC5/RC6 being block ciphers.
NEW QUESTION # 35
(Which encryption process sends a list of cipher suites that are supported for encrypted communications?)
- A. Forward secrecy
- B. Integrity check
- C. ServerHello
- D. ClientHello
Answer: D
Explanation:
In the TLS handshake, the ClientHello message is the client's opening negotiation message and includes the client's supported cryptographic capabilities. A key part of ClientHello is the offered cipher suites list, which advertises combinations of key exchange, authentication, encryption, and integrity/AEAD algorithms the client is willing to use. The server responds with ServerHello, selecting one of the offered cipher suites (in TLS 1.2 and earlier) and confirming protocol parameters. Forward secrecy is a property achieved by using ephemeral key exchange (e.g., (EC)DHE), not a specific message that "sends a list." "Integrity check" is a security goal/mechanism, not the negotiation step. While TLS 1.3 changes the structure of negotiation (cipher suite list still appears in ClientHello but only covers AEAD and hash; key exchange is negotiated via extensions), the fundamental idea remains: the client proposes supported cipher suites in ClientHello, and the server picks compatible parameters. Therefore, the process that sends the list of supported cipher suites is the ClientHello.
NEW QUESTION # 36
(Which mode of encryption converts data into a stream encryption and then uses a counter value and a nonce to encrypt the data?)
- A. Counter (CTR)
- B. Electronic Codebook (ECB)
- C. Cipher Feedback (CFB)
- D. Cipher Block Chaining (CBC)
Answer: A
Explanation:
CTR (Counter) mode converts a block cipher into a stream-like encryption method by generating a keystream from encrypted counter blocks. The core idea is to construct a sequence of input blocks using a nonce (unique per message/session) plus an incrementing counter. Each nonce||counter block is encrypted with the block cipher under the shared key; the output is a pseudorandom block that is XORed with plaintext to produce ciphertext. Decryption repeats the same keystream generation and XORs with ciphertext to recover plaintext. CTR offers practical benefits: it is highly parallelizable, supports precomputation of keystream blocks, and allows random access to any block without needing previous blocks (unlike CBC). ECB and CBC are block modes that do not use nonce+counter keystream generation. CFB is a feedback mode that can behave stream-like, but it does not use the explicit counter/nonce construction characteristic of CTR. CTR's security hinges on never reusing the same nonce/counter sequence with the same key, because that would reuse the keystream and enable XOR-based plaintext recovery. Therefore, the correct mode is Counter (CTR).
NEW QUESTION # 37
(Which component is used to verify the integrity of a message?)
- A. AES
- B. TKIP
- C. IV
- D. HMAC
Answer: D
Explanation:
HMAC (Hash-based Message Authentication Code) is a standard mechanism used to verify both integrity and authenticity of a message when two parties share a secret key. It combines a cryptographic hash function (such as SHA-256) with a secret key in a structured way that resists common attacks on naive keyed-hash constructions. The sender computes an HMAC tag over the message and transmits the message plus tag. The receiver recomputes the HMAC using the same shared secret key and compares the result; if the tag matches, the receiver can be confident the message was not modified in transit and that it came from someone who knows the shared key. AES is an encryption algorithm primarily providing confidentiality; it can provide integrity only when used in authenticated modes (e.g., GCM) but "AES" alone is not the integrity component. An IV helps randomize encryption but does not validate integrity. TKIP is a legacy WLAN protocol component, not the general integrity verifier. Therefore, the correct component for verifying message integrity among the options is HMAC.
NEW QUESTION # 38
(What is the maximum key size (in bits) supported by AES?)
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
AES supports three standardized key sizes: 128, 192, and 256 bits, with a fixed block size of 128 bits.
The maximum of these supported key sizes is 256 bits (AES-256). Key size affects resistance to brute- force key search: larger keys exponentially increase the search space. In practice, AES-128 is already considered strong against brute force with contemporary computing capabilities, while AES-256 is often chosen for compliance requirements, conservative security margins, or to hedge against future advances. AES-512 is not part of the AES standard; if 512-bit keys are desired, systems typically use different constructions (like using AES-256 in certain key-derivation or wrapping schemes) rather than changing AES itself. Therefore, the correct maximum supported AES key size is 256 bits.
NEW QUESTION # 39
(Which technique involves spotting variations in encrypted data and plotting how the characters relate to standard English characters?)
- A. Known plaintext
- B. Brute force
- C. Chosen ciphertext
- D. Frequency analysis
Answer: D
Explanation:
Frequency analysis is a classical cryptanalysis technique that exploits predictable statistical patterns in natural language. In English, certain letters (like E, T, A, O, I, N) occur more frequently than others, and common digrams/trigrams (TH, HE, IN, ER) appear with recognizable distribution. When a cipher preserves character boundaries (as in many substitution ciphers), the ciphertext will also show frequency patterns-though mapped to different symbols. The analyst counts ciphertext character occurrences, compares the distribution to expected English letter frequencies, and infers likely plaintext mappings. "Spotting variations" refers to observing differences in how often symbols appear and using that to plot relationships between ciphertext and standard English. Brute force instead tries all keys; known-plaintext attacks rely on having plaintext-ciphertext pairs; chosen-ciphertext attacks involve decrypting attacker-selected ciphertexts. Those are different attack models. Frequency analysis is specifically about statistical correlation between ciphertext symbols and language characteristics, which is why it is effective against monoalphabetic substitution and weak polyalphabetic schemes with short periods.
NEW QUESTION # 40
(Which authentication method allows a customer to authenticate to a web service?)
- A. One-way server authentication
- B. Mutual authentication
- C. End-to-end authentication
- D. One-way client authentication
Answer: D
Explanation:
One-way client authentication is the method where the client (customer) proves its identity to the server (web service). In cryptographic terms, this is commonly implemented through client credentials such as client TLS certificates (mTLS from the server's perspective) or through authentication protocols layered over TLS (for example, signed tokens), but the defining direction is that the client is the party being authenticated. In a strict TLS certificate-authentication framing, client authentication occurs when the server requests a client certificate during the handshake and the client demonstrates possession of the corresponding private key (via signature in handshake messages). The server then validates the client certificate chain and authorization policy. One-way server authentication, by contrast, authenticates only the server to the client and does not identify the customer. Mutual authentication authenticates both sides simultaneously; while it includes client authentication, it is broader than what the question asks. "End-to-end authentication" describes assurance between endpoints across intermediaries, but it is not the specific "customer authenticates to service" method in certificate-based terminology. Therefore, the best answer is one-way client authentication.
NEW QUESTION # 41
......
WGU Introduction to Cryptography HNO1 Certification Sample Questions and Practice Exam: https://www.test4sure.com/Introduction-to-Cryptography-pass4sure-vce.html