(Jun-2026) Latest Introduction-to-Cryptography Dumps for Success in Actual WGU Certified
Changing the Concept of Introduction-to-Cryptography Exam Preparation 2026
NEW QUESTION # 16
(Which type of network were VPN connections originally designed to tunnel through?)
- A. Encrypted
- B. Private
- C. Protected
- D. Public
Answer: D
Explanation:
A VPN (Virtual Private Network) is designed to create a secure, private communication channel over an otherwise untrusted or shared infrastructure. Historically and conceptually, VPNs were built to allow organizations and users to transmit sensitive traffic across the public Internet while maintaining confidentiality, integrity, and authenticity. The "virtual" aspect means the network behaves like a private link, but the underlying transport is typically a public network where attackers could potentially observe or tamper with traffic. VPN technologies such as IPsec and SSL/TLS-based VPNs encapsulate packets and apply encryption and authentication so that the payload and session metadata are protected even when traversing public routing domains. Options like "encrypted" and "protected" describe properties of the VPN tunnel itself rather than the underlying network it traverses; the VPN provides encryption/protection precisely because the medium is not inherently secure. "Private" would describe a dedicated internal network, which generally does not require a VPN to achieve basic confidentiality. Therefore, VPNs were originally designed to tunnel through public networks.
NEW QUESTION # 17
(Which additional input element can be used to implement integrity in combination with symmetric ciphers?)
- A. Encoding algorithm
- B. Hash function
- C. Initialization vector
- D. Nonce value
Answer: B
Explanation:
Symmetric encryption alone typically provides confidentiality, but it does not automatically provide integrity. Many encryption modes (especially older ones like CBC without authentication) are malleable, meaning an attacker may be able to modify ciphertext and cause predictable changes in plaintext after decryption. To add integrity, systems commonly combine symmetric encryption with a cryptographic hash-based integrity mechanism, such as a hash function used in an HMAC (Hash-based Message Authentication Code) or a dedicated authenticated-encryption mode like GCM that internally uses authentication tags. Among the given options, a hash function is the fundamental additional element that enables integrity checks: it allows construction of a MAC (e.g., HMAC-SHA-256) that the receiver verifies to detect any tampering. An initialization vector and a nonce value are used to ensure uniqueness and randomness properties for encryption but do not, by themselves, guarantee integrity.
An encoding algorithm changes representation, not security. Therefore, the correct additional input element for implementing integrity alongside symmetric encryption is a hash function, typically as part of an HMAC or similar MAC construction.
NEW QUESTION # 18
(Which encryption algorithm encrypts with one key, decrypts with another key, and then encrypts with the first key?)
- A. IDEA
- B. AES
- C. 3DES
- D. DES
Answer: C
Explanation:
3DES (Triple DES) commonly uses an Encrypt-Decrypt-Encrypt (EDE) sequence. In the two-key form, it encrypts with key K1, decrypts with key K2, then encrypts again with K1. In the three-key form, it encrypts with K1, decrypts with K2, then encrypts with K3. The EDE construction was chosen partly for backward compatibility: if K1=K2=K3, the scheme reduces to single DES, allowing older systems to interoperate in constrained ways. AES and IDEA do not use an EDE triple-stage process as their defining structure; they are single-pass block ciphers with internal rounds. DES is a single-pass algorithm (one key) rather than a triple application with multiple keys. Therefore, the algorithm described-encrypt with one key, decrypt with another, encrypt with the first-is 3DES. Although now considered legacy, it remains a classic example of increasing effective security by applying a block cipher multiple times with independent keys.
NEW QUESTION # 19
(What is an alternative to using a Certificate Revocation List (CRL) with certificates?)
- A. Root Certificate Authority (CA)
- B. Online Certificate Status Protocol (OCSP)
- C. Policy Certificate Authority (CA)
- D. Privacy Enhanced Mail (PEM)
Answer: B
Explanation:
OCSP is the primary online alternative to CRLs for checking whether a certificate has been revoked.
With a CRL, a relying party periodically downloads a list of revoked certificate serial numbers published by the issuing CA (or CRL distribution point). That approach can be bandwidth-heavy, introduces latency between revocation and client awareness, and can result in clients using stale revocation data if updates are infrequent. OCSP improves this by allowing a client (or a server on the client's behalf) to query an OCSP responder in near real time about the status of a specific certificate (good, revoked, or unknown). In practice, many TLS deployments use OCSP stapling, where the server periodically fetches a signed OCSP response from the CA's responder and "staples" it to the TLS handshake, reducing client-side network calls and improving privacy (the CA doesn't learn which site the client is visiting). Thus, OCSP provides a more timely, certificate-specific revocation status mechanism than CRLs while preserving the CA's signed assurance.
NEW QUESTION # 20
(Employee A needs to send Employee B a symmetric key for confidential communication. Which key is used to encrypt the symmetric key?)
- A. Employee B's public key
- B. Employee A's public key
- C. Employee A's private key
- D. Employee B's private key
Answer: A
Explanation:
When securely distributing a symmetric key over an untrusted network, a common approach is hybrid cryptography: use asymmetric cryptography to protect the symmetric key, then use the symmetric key for bulk encryption. To ensure only Employee B can recover the symmetric key, Employee A encrypts (wraps) that symmetric key using Employee B's public key. Because only Employee B should possess the matching private key, only B can decrypt the wrapped symmetric key. This is the same principle used in TLS key exchange (in older RSA key transport) and in secure email: encrypt the session key to the recipient's public key. Encrypting the symmetric key with Employee A's private key would not provide confidentiality-anyone with A's public key could reverse it, and it functions more like a signature than encryption. Employee B's private key should never be shared and is used only by B to decrypt. Therefore, for confidentiality of the shared symmetric key, the correct encryption key is Employee B's public key.
NEW QUESTION # 21
(What is the maximum key size (in bits) supported by AES?)
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
AES supports three standardized key sizes: 128, 192, and 256 bits, with a fixed block size of 128 bits.
The maximum of these supported key sizes is 256 bits (AES-256). Key size affects resistance to brute- force key search: larger keys exponentially increase the search space. In practice, AES-128 is already considered strong against brute force with contemporary computing capabilities, while AES-256 is often chosen for compliance requirements, conservative security margins, or to hedge against future advances. AES-512 is not part of the AES standard; if 512-bit keys are desired, systems typically use different constructions (like using AES-256 in certain key-derivation or wrapping schemes) rather than changing AES itself. Therefore, the correct maximum supported AES key size is 256 bits.
NEW QUESTION # 22
(Which wireless security standard uses an authentication server with 802.1X and EAP?)
- A. WPA-Enterprise
- B. WEP
- C. TKIP
- D. WPA-PSK
Answer: A
Explanation:
802.1X is a port-based network access control framework that enables centralized authentication using an authentication server (commonly RADIUS). EAP (Extensible Authentication Protocol) runs within
802.1X to support many credential types (password-based methods like PEAP, certificate-based methods like EAP-TLS, and others). WPA-Enterprise is the wireless security mode that explicitly uses
802.1X + EAP with an authentication server to perform per-user/per-device authentication and to derive dynamic session keys. By contrast, WPA-PSK uses a pre-shared key without an external authentication server; all users share the same PSK, which is weaker for enterprise identity management. WEP is an older mechanism using static keys and does not provide modern 802.1X/EAP enterprise authentication in the WPA-Enterprise sense. TKIP is an encryption/integrity protocol used under WPA, not the full authentication "standard" involving an authentication server. Therefore, the correct choice is WPA-Enterprise.
NEW QUESTION # 23
(What is a component of a one-time password (OTP) that is needed to guess future iterations of passwords?)
- A. Initialization vector
- B. Function
- C. Encryption algorithm
- D. Seed
Answer: D
Explanation:
OTP systems (such as HOTP and TOTP) generate a sequence of passwords using a shared secret and a moving factor (counter or time). The critical secret that underpins the ability to compute past or future OTP values is the seed (also called the shared secret key). In HOTP, the seed is used with an HMAC function and an incrementing counter; in TOTP, the seed is used with HMAC and a time-step value. If an attacker obtains the seed and knows the algorithm and moving factor, they can compute future OTPs. The "function" and "encryption algorithm" are typically standardized and public; security relies on keeping the seed secret. An initialization vector is not a standard OTP component in HOTP
/TOTP generation. Therefore, the component needed to predict future OTP values is the seed.
Protecting the seed is essential: it should be stored securely (e.g., hardware token secure storage) and transmitted only through controlled provisioning processes. If compromised, OTP becomes predictable and no longer serves as a strong second factor.
NEW QUESTION # 24
(How does adding salt to a password improve security?)
- A. Salt prevents users from reusing the same password.
- B. Salt creates a different hash if two people use the same password.
- C. Salt ensures two people do not have the same password.
- D. Salt enforces the complexity rules for passwords.
Answer: B
Explanation:
A salt is a unique, random value stored alongside a password hash and combined with the password during hashing. Its main security benefit is that it ensures identical passwords do not produce identical hashes across different accounts or systems. If two users choose the same password, their stored hashes will differ because their salts differ, which directly prevents attackers from spotting shared passwords by comparing hashes. Salts also defeat precomputation attacks such as rainbow tables, because an attacker would need to regenerate tables for each possible salt value-a task that becomes infeasible when salts are large and unique per password. Salt does not enforce password complexity rules (that's a policy/validation function), does not guarantee users choose different passwords, and does not prevent password reuse across sites. The correct statement is that salt makes the resulting hash different even for the same password, improving resistance to offline cracking at scale and eliminating the "same hash
= same password" shortcut attackers rely on.
NEW QUESTION # 25
(What is the value of 51 mod 11?)
- A. 07
- B. 04
- C. 0
- D. 05
Answer: A
Explanation:
The value 51 mod 11 is the remainder after dividing 51 by 11. Modular arithmetic is widely used in cryptography to keep computations within a finite set of residues, such as in RSA where values are taken modulo n, or in Diffie-Hellman where exponents and group elements are reduced modulo a prime. To compute 51 mod 11, find the largest multiple of 11 less than or equal to 51. Multiples of 11 are 11, 22, 33, 44, 55. The closest without exceeding 51 is 44. Subtracting gives 51 # 44 = 7, so the remainder is 7. Therefore, 51 mod 11 = 7, matching option "07." This remainder is always in the range
0 through 10 because the modulus is 11. Such residue computations underpin the "wraparound" behavior that makes modular exponentiation and inverse computations well-defined in cryptographic groups.
NEW QUESTION # 26
(An administrator has configured a Virtual Private Network (VPN) connection utilizing IPsec transport mode with Encapsulating Security Payload (ESP) between a server in the corporate office and a client computer in the remote office. In which situation can the packet content be inspected?)
- A. In the headquarters' and offsite location's networks after the data has been sent
- B. Only in the offsite location's network while data is in transit
- C. On devices at headquarters and offsite before being sent and after being received
- D. Only in the headquarters' network while data is in transit
Answer: C
Explanation:
With IPsec ESP in transport mode, the payload of the original IP packet (typically the transport-layer segment and higher) is encrypted and integrity-protected between the two endpoints-here, the corporate server and the remote client. Because encryption is applied by the sending endpoint and removed only by the receiving endpoint, intermediate routers, switches, and monitoring devices in either network cannot view the protected payload while it is in transit. They may see outer IP headers and certain metadata needed for routing, but not the encrypted content protected by ESP. As a result, the packet's contents are inspectable only at the endpoints: before encryption on the sender (plaintext exists in memory/stack before IPsec processing) and after decryption on the receiver (plaintext is restored for the application). This is true whether the traffic traverses internal networks or the Internet; the cryptographic boundary is between the endpoints participating in the IPsec SA.
Therefore, inspection of the actual content is possible only on the devices at headquarters and offsite, before sending and after receiving, not by in-transit networks.
NEW QUESTION # 27
(Which authentication method allows a customer to authenticate to a web service?)
- A. One-way client authentication
- B. Mutual authentication
- C. One-way server authentication
- D. End-to-end authentication
Answer: A
Explanation:
One-way client authentication is the method where the client (customer) proves its identity to the server (web service). In cryptographic terms, this is commonly implemented through client credentials such as client TLS certificates (mTLS from the server's perspective) or through authentication protocols layered over TLS (for example, signed tokens), but the defining direction is that the client is the party being authenticated. In a strict TLS certificate-authentication framing, client authentication occurs when the server requests a client certificate during the handshake and the client demonstrates possession of the corresponding private key (via signature in handshake messages). The server then validates the client certificate chain and authorization policy. One-way server authentication, by contrast, authenticates only the server to the client and does not identify the customer. Mutual authentication authenticates both sides simultaneously; while it includes client authentication, it is broader than what the question asks. "End-to-end authentication" describes assurance between endpoints across intermediaries, but it is not the specific "customer authenticates to service" method in certificate-based terminology. Therefore, the best answer is one-way client authentication.
NEW QUESTION # 28
(Which cipher uses shifting letters of the alphabet for encryption?)
- A. Vigenere
- B. Bifid
- C. SHA-1
- D. Caesar
Answer: D
Explanation:
The Caesar cipher is the classic substitution cipher that encrypts by shifting letters of the alphabet by a fixed number of positions (e.g., shift by 3: A#D, B#E, etc.). It is a monoalphabetic cipher because a single shift value is applied uniformly across the entire message, making it simple and vulnerable to frequency analysis and brute force (only 25 meaningful shifts in the Latin alphabet). Vigenere also involves shifting, but it uses a repeating keyword to vary the shift per character (polyalphabetic), whereas the question's phrasing typically points to the fundamental "shift cipher," which is Caesar.
SHA-1 is a cryptographic hash function, not a cipher. Bifid is a fractionation cipher combining Polybius square coordinates and transposition, not a direct shifting method. Therefore, the cipher that uses shifting letters of the alphabet for encryption is the Caesar cipher.
NEW QUESTION # 29
(Which encryption algorithm uses an 80-bit key and operates on 64-bit data blocks?)
- A. Camellia
- B. Twofish
- C. Blowfish
- D. Skipjack
Answer: D
Explanation:
Skipjack is a symmetric block cipher historically associated with the Clipper chip initiative. Its defining parameters match the question: it operates on 64-bit blocks and uses an 80-bit key. The other options do not fit those exact sizes. Twofish is a 128-bit block cipher with key sizes up to 256 bits. Blowfish is a
64-bit block cipher, but its key size is variable from 32 up to 448 bits and is not fixed at 80 bits as a defining property. Camellia is a 128-bit block cipher with key sizes of 128, 192, or 256 bits. Skipjack's smaller key size and legacy design make it unsuitable for modern security needs, but the question is purely about identifying the algorithm that matches an 80-bit key and 64-bit blocks. Therefore, the correct answer is Skipjack.
NEW QUESTION # 30
(How does Electronic Codebook (ECB) mode encryption function?)
- A. Uses a self-synchronizing stream on the blocks, where the IV is encrypted and XORed with the data stream
- B. Encrypts each block with the same key, where each block is independent of the others
- C. Converts from block to stream, then uses a counter value and a nonce to encrypt the data
- D. Uses an IV to encrypt the first block, then uses the result to encrypt the next block
Answer: B
Explanation:
ECB is the simplest block cipher mode: each plaintext block is encrypted independently using the same key and the block cipher primitive. There is no IV and no chaining, so identical plaintext blocks produce identical ciphertext blocks. This property leaks patterns and structure in the plaintext, which is why ECB is generally considered insecure for most real-world data beyond tiny, random-looking inputs. For example, images encrypted with ECB often reveal outlines because repeated pixel blocks map to repeated ciphertext blocks. Option A describes CTR mode, option C describes CBC mode, and option B resembles feedback-based modes. ECB's independence also means it can be parallelized, but the pattern leakage is a severe weakness. Modern practice prefers authenticated encryption modes (like GCM) or, at minimum, modes with IVs and chaining (like CBC with proper padding and MAC).
Therefore, the correct statement is that ECB encrypts each block with the same key and each block is independent of the others.
NEW QUESTION # 31
(What type of encryption uses different keys to encrypt and decrypt the message?)
- A. Private key
- B. Symmetric
- C. Secure
- D. Asymmetric
Answer: D
Explanation:
Asymmetric encryption (also called public key cryptography) uses a pair of mathematically related keys: a public key and a private key. One key is used to encrypt, and the other is used to decrypt, which is the defining "different keys" property asked in the question. In the common confidentiality use case, a sender encrypts a message using the recipient's public key, and only the recipient can decrypt it using their private key. This solves the key distribution problem inherent in symmetric encryption, where both parties must securely share the same secret key in advance. Asymmetric systems also enable digital signatures: the private key signs (creates a signature) and the public key verifies it, providing authenticity and integrity. Symmetric encryption, by contrast, uses the same shared key for both encryption and decryption (even though internal round keys may exist, it is still one shared secret).
"Private key" alone is not a full encryption type, and "secure" is a generic description rather than a cryptographic category. Therefore, the correct answer is D. Asymmetric.
NEW QUESTION # 32
(A company wants to use certificates issued by a root CA to demonstrate to customers that it is a legitimate company being hosted by a cloud provider. Who needs to trust the root CA public key?)
- A. The buyer and the Federal Trade Commission
- B. The Federal Trade Commission and the cloud provider
- C. The seller and the buyer
- D. The cloud provider and the seller
Answer: C
Explanation:
In a public key infrastructure, trust in a certificate ultimately depends on the relying party's trust anchor set-typically the root CA certificates preinstalled in a customer's browser/OS trust store. For customers to accept the company's certificate as legitimate, the buyer (customer) must trust the root CA public key (or an intermediate chained to it) so they can validate the certificate chain and signatures. The seller (the company) also must trust and rely on the root CA public key to build and present a valid chain and to make operational decisions based on that CA's issuance and revocation mechanisms; practically, the seller selects a CA whose root is widely trusted by customers. The cloud provider's trust is not what makes the certificate valid to customers; the provider may terminate TLS or pass traffic through, but customer validation is based on the chain to a trusted root. Government agencies like the FTC are not part of the cryptographic trust path for TLS certificate validation.
Therefore, among the given options, the correct pairing is the seller and the buyer, reflecting both the issuer selection/usage by the company and the relying-party validation by customers.
NEW QUESTION # 33
......
Introduction-to-Cryptography Exam Crack Test Engine Dumps Training With 62 Questions: https://examcollection.guidetorrent.com/Introduction-to-Cryptography-dumps-questions.html