Question Q-5962 Which key exchange algorithm provides perfect forward secrecy while being…
2 comments · last active May 23, 2026
CompTIA Security+ - Cryptography and PKI
By Jordan Blake · Updated May 25, 2026
| Questions | 23 |
| Passing Score | 75% |
| Format | 52% Multiple Choice |
| Sessions Logged | 616 |
| Your progress | Log in / Register to track times taken, best score, questions mastered, and coverage on this quiz. |
| Rating |
Topics covered
Uncategorized23 questions
Discussion
Log in to post a comment, reply, or expand a question.
TLS 1.3 dropped a lot of weak ciphers. Perfect forward secrecy = ephemeral DH keys per session.
Certificate pinning stops rogue CA issuing valid-looking certs for your app — mobile apps use this a lot.
Digital signature: private key signs, public key verifies. Opposite of confidentiality (encrypt with public, decrypt with private).
Non-repudiation = signatures. Integrity often = hash. Know which property each control gives you.
CA signs subscriber certs; CRL/OCSP handles revocation. Expired cert = browser warning even if key is fine.
Self-signed is OK for labs; production needs trusted chain to a public root in the trust store.
MD5 is broken for security — collisions since mid-2000s. SHA-256/SHA-3 are the safe picks on the exam.
+2 votesSHA-1 also deprecated (SHAttered). If they ask 'still used where?' — legacy compatibility, not new designs.
Steganography hides data in media; obfuscation ≠ encryption. Low and slow exfil sometimes uses both.
Quantum-resistant algorithms are awareness-level on Sec+ — know NIST is standardizing PQC, not memorize math.
Key escrow vs key recovery — government/compliance scenarios. HSM = keys never leave hardware in plaintext.
Rotation schedule depends on data classification and compliance, not 'never rotate asymmetric keys' myth.
Symmetric = one shared secret, fast. Asymmetric = key pair, solves distribution. TLS uses both (hybrid).
AES for bulk data, RSA/ECC for key exchange and signatures — that's the practical split.
Wildcard cert (*.example.com) is convenient but blast radius if compromised — SAN certs more granular.
EV certs barely matter in browsers now; know the concept for legacy questions only.
Question catalog for this preview
Catalog listing of the 5 preview questions for this quiz.
Question 1
?? True/False (Medium)
A self-signed certificate provides the same level of trust as a CA-signed certificate.
Explanation
A self-signed certificate is signed by the same entity whose identity it certifies — like writing your own reference letter. There is no third-party verification of identity. Browsers display security warnings for self-signed certificates because users cannot verify the issuer's identity. CA-signed certificates are trusted because browsers pre-installed trusted CA root certificates.
Question 2
?? Multiple Choice (Easy)
What is the difference between symmetric and asymmetric encryption?
Explanation
Symmetric encryption (AES, DES, 3DES): same key encrypts and decrypts — fast but key distribution is a challenge. Asymmetric encryption (RSA, ECC): public key encrypts, private key decrypts (or private signs, public verifies) — slow but solves key distribution. In practice, asymmetric exchanges a symmetric session key (hybrid approach used in TLS).
Question 3
?? True/False (Hard)
The process of key escrow involves storing a copy of encryption keys with a trusted third party, allowing authorized recovery if the original key is lost.
Explanation
Key escrow is required in some enterprise and government environments. An encrypted copy of private keys is held by an escrow agent (trusted third party or the organization's IT department). This allows recovery of encrypted data if employees leave or keys are lost. It is controversial in government use (Clipper Chip proposal) due to privacy implications.
Question 4
?? Multiple Choice (Easy)
What does PKI stand for?
Explanation
PKI is a framework of policies, procedures, hardware, software, and people for creating, managing, distributing, and revoking digital certificates. Key PKI components: Certificate Authority (CA), Registration Authority (RA), Certificate Revocation Lists (CRL), OCSP, and digital certificates (X.509 standard).
Question 5
?? Multiple Choice (Hard)
Which algorithm is used in ECDSA (Elliptic Curve Digital Signature Algorithm) that makes random nonce (k) reuse catastrophic?
Explanation
In ECDSA, if the same nonce k is used to sign two different messages, an attacker with both signatures can solve a system of equations to recover the private key. This happened to Sony PlayStation 3 (same k used for all code signing) and Bitcoin wallets that reused nonces. RFC 6979 uses deterministic k generation to prevent this.
AES modes: GCM gives confidentiality + authenticity. ECB is insecure for patterns — exam still mentions it as wrong answer.
CBC needs proper IV handling; padding oracle attacks are why GCM/ChaCha20-Poly1305 won.