Free Introduction-to-Cryptography Exam Study Guide for the NEW [Oct-2026] Dumps Test Engine [Q36-Q54]

admin -

October 8, 2026

Rate this post

Free Introduction-to-Cryptography Exam Study Guide for the NEW [Oct-2026] Dumps Test Engine

Introduction-to-Cryptography PDF Dumps Extremely Quick Way Of Preparation

WGU Introduction-to-Cryptography Exam Syllabus Topics:

Section	Objectives
Symmetric Cryptography	– Stream Ciphers – Key Management – Initialization Vectors (IV) – Block Ciphers (AES, DES, 3DES)
Asymmetric Cryptography	– Elliptic Curve Cryptography (ECC) – RSA Algorithm – Diffie-Hellman Key Exchange – Public Key Infrastructure (PKI)
Cryptanalysis and Attacks	– Common Attack Vectors – Brute Force and Dictionary Attacks – Social Engineering Prevention
Cryptography Fundamentals	– Cryptographic Terminology – History and Evolution of Cryptography – Symmetric vs Asymmetric Encryption
Applied Cryptography	– Cryptographic Best Practices – VPN Security – PGP and Email Encryption – SSL/TLS Protocols
Hashing and Digital Signatures	– Digital Signature Standards – Hash Functions (MD5, SHA-1, SHA-256) – Message Authentication Codes (MAC)

NO.36 (How can auditing enhance an organization ‘ s cryptographic practices?)

It identifies weaknesses in current practices.

It guarantees that no security incidents will occur.

It eliminates the need for regular policy updates.

It ensures all employees are trained in cryptography.

Auditing improves cryptographic practice by systematically evaluating whether cryptographic controls are correctly selected, implemented, configured, and maintained. Through audits, an organization can discover weak algorithms (e.g., deprecated hashes), improper key lengths, unsafe modes (e.g., unauthenticated CBC), missing integrity controls, poor certificate validation, and operational problems such as key reuse, weak randomness sources, inadequate rotation, or overly permissive access to key material. Audits also assess compliance with internal policy and external standards, ensuring crypto is used consistently across systems and that exceptions are documented and risk-managed. Importantly, auditing does not guarantee that incidents will never happen; it reduces risk by finding gaps before attackers do. It also does not eliminate the need for updates-audits often reveal that policies must evolve as threats and best practices change. Employee training can be recommended as an outcome of auditing, but audits do not automatically ensure training. Thus, the most accurate benefit is that auditing identifies weaknesses and drives corrective action, strengthening cryptographic posture over time.

NO.37 (An administrator has configured a Virtual Private Network (VPN) connection utilizing IPsec transport mode with Encapsulating Security Payload (ESP) between a server in the corporate office and a client computer in the remote office. In which situation can the packet content be inspected?)

On devices at headquarters and offsite before being sent and after being received

In the headquarters’ and offsite location’s networks after the data has been sent

Only in the offsite location’s network while data is in transit

Only in the headquarters’ network while data is in transit

With IPsec ESP in transport mode, the payload of the original IP packet (typically the transport-layer segment and higher) is encrypted and integrity-protected between the two endpoints-here, the corporate server and the remote client. Because encryption is applied by the sending endpoint and removed only by the receiving endpoint, intermediate routers, switches, and monitoring devices in either network cannot view the protected payload while it is in transit. They may see outer IP headers and certain metadata needed for routing, but not the encrypted content protected by ESP. As a result, the packet’s contents are inspectable only at the endpoints: before encryption on the sender (plaintext exists in memory/stack before IPsec processing) and after decryption on the receiver (plaintext is restored for the application). This is true whether the traffic traverses internal networks or the Internet; the cryptographic boundary is between the endpoints participating in the IPsec SA.
Therefore, inspection of the actual content is possible only on the devices at headquarters and offsite, before sending and after receiving, not by in-transit networks.

NO.38 (What is the value of 23 mod 6?)

The expression 23 mod 6 asks for the remainder when 23 is divided by 6. Modular arithmetic is foundational in cryptography, especially in public-key systems (RSA, Diffie-Hellman, ECC) where operations occur in finite rings or fields. To compute 23 mod 6, identify the largest multiple of 6 that does not exceed 23.
Multiples of 6 are 6, 12, 18, 24. Since 24 is greater than 23, the largest valid multiple is 18. Subtract: 23 # 18
= 5, so the remainder is 5. Therefore, 23 mod 6 = 5, which corresponds to option “05.” Modular reduction keeps numbers within a fixed range (0 to modulus#1), enabling stable arithmetic under wraparound behavior.
In cryptographic protocols, this wraparound property is essential for defining groups and ensuring operations remain bounded and consistent.

NO.39 (What is used to randomize the initial value when generating Initialization Vectors (IVs)?)

Key

Plaintext

Algorithm

Nonce

An IV (Initialization Vector) is a value used to ensure that encrypting identical plaintext under the same key produces different ciphertexts, preventing pattern leakage. In many secure designs, the IV must be unique (and often unpredictable) per encryption operation. A common way to ensure uniqueness is to incorporate a nonce-a “number used once.” A nonce can be random, pseudo-random, or a counter-based value depending on the mode and security requirements. For example, CTR mode uses a nonce combined with a counter to produce unique input blocks; GCM uses a nonce/IV to ensure unique authentication and encryption behavior.
The encryption key should remain stable across many operations and should not be used as the “randomizer” for IV generation; mixing key material into IV creation in an ad hoc way can create reuse or correlation issues. Plaintext and algorithm do not provide the needed uniqueness property. The nonce concept is specifically about ensuring one-time uniqueness of the starting value so that IV reuse does not repeat keystream blocks (stream modes) or reveal plaintext equality (CBC/CTR). Therefore, the correct choice is Nonce.

NO.40 (Which type of exploit involves looking for different inputs that generate the same hash?)

Birthday attack

Linear cryptanalysis

Algebraic attack

Differential cryptanalysis

A birthday attack targets hash functions by exploiting the birthday paradox: collisions (two different inputs producing the same hash output) can be found much faster than brute-forcing a specific preimage. For an n-bit hash, the expected work t o find any collision is on the order of 2^(n/2), not 2^n. The attack is relevant because many security constructions rely on collision resistance-digital signatures, certificate fingerprints, integrity checks, and some commitment schemes. If an attacker ca n generate two different documents with the same hash, they may trick a signer into signing one version while later presenting the other as “signed,” depending on the protocol. Linear cryptanalysis and differential cryptanalysis are primarily techniques ag ainst block ciphers, analyzing relationships between plaintext/ciphertext differences or linear approximations across rounds. Algebraic attacks treat the cipher as a system of equations. The description “looking for different inputs that generate the same hash” is the hallmark of collision-finding, and the classic framing for that is the birthday attack.

NO.41 (Which certificate encoding process is binary-based?)

Public Key Infrastructure (PKI)

Distinguished Encoding Rules (DER)

Rivest-Shamir-Adleman (RSA)

Privacy Enhanced Mail (PEM)

DER (Distinguished Encoding Rules) is a binary encoding format used to represent ASN.1 structures in a canonical, unambiguous way. X.509 certificates are defined using ASN.1, and DER provides a strict subset of BER (Basic Encoding Rules) that guarantees a single, unique encoding for any given data structure. That “unique encoding” property is important for cryptographic operations such as hashing and digital signatures, because different encodings of the same abstract data could otherwise produce different hashes and break signature verification. In contrast, PEM is not a binary encoding; it is essentially a Base64-encoded text wrapper around DER data, bounded by header/footer lines (e.g.,
“BEGIN CERTIFICATE”). PKI is an overall framework for certificate issuance, trust, and lifecycle management-not an encoding. RSA is an asymmetric algorithm used for encryption/signing, not a certificate encoding format. Therefore, the binary-based certificate encoding process among the options is DER.

NO.42 (Which operation can be performed on a certificate during the “Issued” stage?)

Creation

Key recovery

Distribution

Key archiving

The “Issued” stage in a certificate lifecycle indicates that the certificate has been generated and signed by the issuing CA and is now valid for use (subject to validity dates, policy constraints, and revocation status). At this point, the operational focus shifts from creating the certificate to making it available to the subject and relying parties. “Distribution” is the lifecycle activity most directly associated with an issued certificate:
installing it on servers or endpoints, provisioning it into keystores, publishing it to directories if required, and ensuring the chain (intermediates) is accessible for validation. By contrast, “Creation” is earlier in the process (key generation, CSR creation, identity validation, issuance/signing). “Key recovery” and “key archiving” relate to private key management and escrow policies (often for encryption keys, not signing keys), and are governed by organizational policy and key management systems rather than the certificate’s issued state itself.
A certificate can be distributed after issuance regardless of whether any key escrow features exist. Therefore, the operation that fits the certificate’s “Issued” stage best is distribution of the issued credential for operational use.

NO.43 (What is a component of a one-time password (OTP) that is needed to guess future iterations of passwords?)

Function

Initialization vector

Encryption algorithm

Seed

OTP systems (such as HOTP and TOTP) generate a sequence of passwords using a shared secret and a moving factor (counter or time). The critical secret that underpins the ability to compute past or future OTP values is the seed (also called the shared secret key). In HOTP, the seed is used with an HMAC function and an incrementing counter; in TOTP, the seed is used with HMAC and a time-step value. If an attacker obtains the seed and knows the algorithm and moving factor, they can compute future OTPs. The “function” and
“encryption algorithm” are typically standardized and public; security relies on keeping the seed secret. An initialization vector is not a standard OTP component in HOTP/TOTP generation. Therefore, the component needed to predict future OTP values is the seed. Protecting the seed is essential: it should be stored securely (e.
g., hardware token secure storage) and transmitted only through controlled provisioning processes. If compromised, OTP becomes predictable and no longer serves as a strong second factor.

NO.44 (What is an alternative to using a Certificate Revocation List (CRL) with certificates?)

Privacy Enhanced Mail (PEM)

Online Certificate Status Protocol (OCSP)

Root Certificate Authority (CA)

Policy Certificate Authority (CA)

OCSP is the primary online alternative to CRLs for checking whether a certificate has been revoked.
With a CRL, a relying party periodically downloads a list of revoked certificate serial numbers published by the issuing CA (or CRL distribution point). That approach can be bandwidth-heavy, introduces latency between revocation and client awareness, and can result in clients using stale revocation data if updates are infrequent. OCSP improves this by allowing a client (or a server on the client’s behalf) to query an OCSP responder in near real time about the status of a specific certificate (good, revoked, or unknown). In practice, many TLS deployments use OCSP stapling, where the server periodically fetches a signed OCSP response from the CA’s responder and “staples” it to the TLS handshake, reducing client-side network calls and improving privacy (the CA doesn’t learn which site the client is visiting). Thus, OCSP provides a more timely, certificate-specific revocation status mechanism than CRLs while preserving the CA’s signed assurance.

NO.45 (What is the value of 51 mod 11?)

The value 51 mod 11 is the remainder after dividing 51 by 11. Modular arithmetic is widely used in cryptography to keep computations within a finite set of residues, such as in RSA where values are taken modulo n, or in Diffie-Hellman where exponents and group elements are reduced modulo a prime. To compute 51 mod 11, find the largest multiple of 11 less than or equal to 51. Multiples of 11 are 11, 22, 33, 44, 55. The closest without exceeding 51 is 44. Subtracting gives 51 # 44 = 7, so the remainder is 7. Therefore, 51 mod 11 = 7, matching option “07.” This remainder is always in the range
0 through 10 because the modulus is 11. Such residue computations underpin the “wraparound” behavior that makes modular exponentiation and inverse computations well-defined in cryptographic groups.

NO.46 (How does Electronic Codebook (ECB) mode encryption function?)

Converts from block to stream, then uses a counter value and a nonce to encrypt the data

Uses a self-synchronizing stream on the blocks, where the IV is encrypted and XORed with the data stream

Uses an IV to encrypt the first block, then uses the result to encrypt the next block

Encrypts each block with the same key, where each block is independent of the others

ECB is the simplest block cipher mode: each plaintext block is encrypted independently using the same key and the block cipher primitive. There is no IV and no chaining, so identical plaintext blocks produce identical ciphertext blocks. This property leaks patterns and structure in the plaintext, which is why ECB is generally considered insecure for most real-world data beyond tiny, random-looking inputs. For example, images encrypted with ECB often reveal outlines because repeated pixel blocks map to repeated ciphertext blocks.
Option A describes CTR mode, option C describes CBC mode, and option B resembles feedback-based modes. ECB’s independence also means it can be parallelized, but the pattern leakage is a severe weakness.
Modern practice prefers authenticated encryption modes (like GCM) or, at minimum, modes with IVs and chaining (like CBC with proper padding and MAC). Therefore, the correct statement is that ECB encrypts each block with the same key and each block is independent of the others.

NO.47 (How can auditing enhance an organization ‘ s cryptographic practices?)

It guarantees that no security incidents will occur.

It eliminates the need for regular policy updates.

It identifies weaknesses in current practices.

It ensures all employees are trained in cryptography.

NO.48 (What is a characteristic of Cipher Block Chaining (CBC) mode in cryptography?)

It encrypts each block of plaintext dependent on the previous block.

It generates a continuous stream of key material.

It requires a different key for each encryption operation.

It operates on 32-bit blocks.

CBC mode introduces chaining between blocks to prevent the pattern leakage inherent in ECB. In CBC, each plaintext block is XORed with the previous ciphertext block before being encrypted with the block cipher. For the first block, CBC uses an Initialization Vector (IV) to serve as the “previous ciphertext” input. This makes encryption of each block dependent on the previous block’s ciphertext, which is exactly the defining characteristic described in option A. CBC does not generate a continuous stream of key material-that describes stream ciphers or stream-like modes such as CTR/OFB. CBC also does not require a different key per operation; the same symmetric key is reused, while the IV must be fresh/unpredictable to ensure semantic security. The block size is determined by the underlying block cipher (e.g., AES is 128-bit blocks, DES/3DES are 64-bit blocks), not a fixed 32-bit size for CBC itself. Because CBC is not inherently authenticated, best practice is to pair it with a MAC (Encrypt-then-MAC) or use an AEAD mode instead.

NO.49 (A Linux user password is identified as follows:
$2a$08$AbCh0RCM8p8FGaYvRLI0H.Kng54gcnWCOQYIhas708UEZRQQjGBh4
Which hash algorithm should be used to salt this password?)

NTLM

SHA-512

MD5

bcrypt

The string format $2a$08$… is a well-known identifier for the bcrypt password hashing scheme. In common password-hash notation, the prefix indicates the algorithm and parameters: “$2a$” denotes bcrypt (version 2a), and “08” indicates the cost factor (work factor) controlling how computationally expensive hashing is. bcrypt is designed specifically for password storage: it includes a built-in salt and is intentionally slow and adaptive, making brute-force and GPU attacks far more expensive than fast general-purpose hashes like MD5 or SHA-512. NTLM and MD5 are obsolete for secure password storage due to speed and known weaknesses. SHA-512, while cryptographically strong as a hash, is still too fast for password hashing unless used in a dedicated password-hashing construction (e.g., PBKDF2, scrypt, Argon2) with appropriate parameters and salts. Since the given hash clearly matches bcrypt’s encoding, the correct algorithm is bcrypt, which incorporates salting and cost-based key stretching as part of its design.

NO.50 (An organization wants to digitally sign its software to guarantee the integrity of its source code. Which key should the customer use to decrypt the digest of the source code?)

Customer’s private key

Organization’s public key

Organization’s private key

Customer’s public key

When software is digitally signed, the organization computes a cryptographic hash (digest) of the software (or its manifest) and then signs that digest using the organization’s private key. Verification works in the opposite direction: the customer (verifier) uses the organization’s public key to validate the signature and recover/confirm the signed digest, then independently hashes the received software and compares the result. If the digests match and the signature validates under the public key, the customer has strong assurance that the software has not been altered since it was signed and that it was signed by the holder of the corresponding private key. The customer never needs the organization’s private key-sharing it would destroy security and enable forgery. Likewise, the customer’s own keys are irrelevant to verifying the publisher’s signature. The organization’s public key is typically delivered inside a certificate chain (code signing certificate) so the verifier can also validate publisher identity and trust. Therefore, the customer uses the organization’s public key for signature verification (often described as “decrypting” the signed digest).

NO.51 (What is a focus of the ISO/IEC 27001 standard?)

Development of new encryption algorithms

Risk management and continuous improvement of information security

Enforcement of criminal penalties for data breaches

Exclusively addressing network security

ISO/IEC 27001 is an international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Its focus is not inventing cryptographic algorithms, but managing information security through a structured governance approach: identifying assets, assessing risks, selecting and implementing controls, measuring effectiveness, and continuously improving.
The standard emphasizes a risk-based methodology-controls are chosen based on organizational context and threat landscape, and the ISMS is refined over time through audits, management reviews, and corrective actions. While cryptography can be part of the control set (e.g., encryption policies, key management, secure communications), ISO/IEC 27001 addresses a broad range of security domains beyond crypto, including physical security, access control, incident management, supplier relationships, and business continuity. It also does not enforce criminal penalties; it is a certification/management standard. And it is not limited to network security. Therefore, the correct focus is risk management and continuous improvement of information security.

NO.52 (What type of encryption uses different keys to encrypt and decrypt the message?)

Symmetric

Private key

Secure

Asymmetric

Asymmetric encryption (also called public key cryptography) uses a pair of mathematically related keys: a public key and a private key. One key is used to encrypt, and the other is used to decrypt, which is the defining “different keys” property asked in the question. In the common confidentiality use case, a sender encrypts a message using the recipient’s public key, and only the recipient can decrypt it using their private key. This solves the key distribution problem inherent in symmetric encryption, where both parties must securely share the same secret key in advance. Asymmetric systems also enable digital signatures: the private key signs (creates a signature) and the public key verifies it, providing authenticity and integrity. Symmetric encryption, by contrast, uses the same shared key for both encryption and decryption (even though internal round keys may exist, it is still one shared secret).
“Private key” alone is not a full encryption type, and “secure” is a generic description rather than a cryptographic category. Therefore, the correct answer is D. Asymmetric.

NO.53 (Which authentication method allows a customer to authenticate to a web service?)

One-way server authentication

End-to-end authentication

Mutual authentication

One-way client authentication

One-way client authentication is the method where the client (customer) proves its identity to the server (web service). In cryptographic terms, this is commonly implemented through client credentials such as client TLS certificates (mTLS from the server’s perspective) or through authentication protocols layered over TLS (for example, signed tokens), but the defining direction is that the client is the party being authenticated. In a strict TLS certificate-authentication framing, client authentication occurs when the server requests a client certificate during the handshake and the client demonstrates possession of the corresponding private key (via signature in handshake messages). The server then validates the client certificate chain and authorization policy. One-way server authentication, by contrast, authenticates only the server to the client and does not identify the customer. Mutual authentication authenticates both sides simultaneously; while it includes client authentication, it is broader than what the question asks. “End-to-end authentication” describes assurance between endpoints across intermediaries, but it is not the specific “customer authenticates to service” method in certificate-based terminology. Therefore, the best answer is one-way client authentication.

NO.54 (Which attack may take the longest amount of time to achieve success?)

Birthday

Rainbow table

Dictionary

Brute-force

A brute-force attack exhaustively tries every possible key or password candidate until the correct one is found. Because it explores the full search space (or a very large portion of it), brute force is often the slowest method, especially when strong keys, long passwords, rate limits, and slow password hashing (bcrypt
/Argon2) are used. By contrast, a dictionary attack reduces work by trying only common or likely passwords, often succeeding quickly against weak human-chosen secrets. Rainbow table attacks shift work into precomputation; once a table exists, lookup can be faster than brute-force-though salt and modern hashing defeat them. Birthday attacks are about finding collisions, not necessarily recovering a specific secret, and their expected work is about 2^(n/2) for an n-bit hash, which can be less than brute-force key search in many contexts. Therefore, among the listed options, brute-force generally takes the longest to succeed because it makes the fewest assumptions and does the most total work.

Loading …