Pass Your Introduction-to-Cryptography Exam at the First Try with 100% Real Exam Questions
New WGU Introduction-to-Cryptography Dumps & Questions Updated on 2026
NEW QUESTION # 25
(What is an attribute of RC4 when used with WEP?)
- A. 128-bit key
- B. 40-bit key
- C. 512-bit key
- D. 256-bit key
Answer: B
Explanation:
In classic WEP deployments, RC4 was used with what is commonly called "40-bit WEP" (also labeled
"64-bit WEP" because it combines a 40-bit secret key with a 24-bit IV to form a 64-bit RC4 seed). The key attribute emphasized in many foundational descriptions of WEP is this 40-bit shared secret length, which was originally chosen due to export restrictions and legacy constraints. Although "104-bit WEP" (sometimes called "128-bit WEP," again counting the 24-bit IV) also existed, the option set here points to the historically standard and widely referenced attribute: a 40-bit key when RC4 is used in WEP.
Importantly, WEP's security failure is not only about key size; the 24-bit IV is too small and repeats frequently, and WEP's key scheduling vulnerabilities combined with IV reuse allow attackers to recover the secret key with enough captured frames. Still, among the given options, the correct attribute is the 40-bit key.
NEW QUESTION # 26
(What is the value of 23 mod 6?)
- A. 03
- B. 06
- C. 04
- D. 05
Answer: D
Explanation:
The expression 23 mod 6 asks for the remainder when 23 is divided by 6. Modular arithmetic is foundational in cryptography, especially in public-key systems (RSA, Diffie-Hellman, ECC) where operations occur in finite rings or fields. To compute 23 mod 6, identify the largest multiple of 6 that does not exceed 23. Multiples of 6 are 6, 12, 18, 24. Since 24 is greater than 23, the largest valid multiple is 18. Subtract: 23 # 18 = 5, so the remainder is 5. Therefore, 23 mod 6 = 5, which corresponds to option
"05." Modular reduction keeps numbers within a fixed range (0 to modulus#1), enabling stable arithmetic under wraparound behavior. In cryptographic protocols, this wraparound property is essential for defining groups and ensuring operations remain bounded and consistent.
NEW QUESTION # 27
(What type of encryption uses different keys to encrypt and decrypt the message?)
- A. Asymmetric
- B. Symmetric
- C. Secure
- D. Private key
Answer: A
Explanation:
Asymmetric encryption (also called public key cryptography) uses a pair of mathematically related keys: a public key and a private key. One key is used to encrypt, and the other is used to decrypt, which is the defining "different keys" property asked in the question. In the common confidentiality use case, a sender encrypts a message using the recipient's public key, and only the recipient can decrypt it using their private key. This solves the key distribution problem inherent in symmetric encryption, where both parties must securely share the same secret key in advance. Asymmetric systems also enable digital signatures: the private key signs (creates a signature) and the public key verifies it, providing authenticity and integrity. Symmetric encryption, by contrast, uses the same shared key for both encryption and decryption (even though internal round keys may exist, it is still one shared secret).
"Private key" alone is not a full encryption type, and "secure" is a generic description rather than a cryptographic category. Therefore, the correct answer is D. Asymmetric.
NEW QUESTION # 28
(Which technique involves spotting variations in encrypted data and plotting how the characters relate to standard English characters?)
- A. Chosen ciphertext
- B. Known plaintext
- C. Brute force
- D. Frequency analysis
Answer: D
Explanation:
Frequency analysis is a classical cryptanalysis technique that exploits predictable statistical patterns in natural language. In English, certain letters (like E, T, A, O, I, N) occur more frequently than others, and common digrams/trigrams (TH, HE, IN, ER) appear with recognizable distribution. When a cipher preserves character boundaries (as in many substitution ciphers), the ciphertext will also show frequency patterns-though mapped to different symbols. The analyst counts ciphertext character occurrences, compares the distribution to expected English letter frequencies, and infers likely plaintext mappings. "Spotting variations" refers to observing differences in how often symbols appear and using that to plot relationships between ciphertext and standard English. Brute force instead tries all keys; known-plaintext attacks rely on having plaintext-ciphertext pairs; chosen-ciphertext attacks involve decrypting attacker-selected ciphertexts. Those are different attack models. Frequency analysis is specifically about statistical correlation between ciphertext symbols and language characteristics, which is why it is effective against monoalphabetic substitution and weak polyalphabetic schemes with short periods.
NEW QUESTION # 29
(Which authentication method allows a customer to authenticate to a web service?)
- A. Mutual authentication
- B. One-way server authentication
- C. End-to-end authentication
- D. One-way client authentication
Answer: D
Explanation:
One-way client authentication is the method where the client (customer) proves its identity to the server (web service). In cryptographic terms, this is commonly implemented through client credentials such as client TLS certificates (mTLS from the server's perspective) or through authentication protocols layered over TLS (for example, signed tokens), but the defining direction is that the client is the party being authenticated. In a strict TLS certificate-authentication framing, client authentication occurs when the server requests a client certificate during the handshake and the client demonstrates possession of the corresponding private key (via signature in handshake messages). The server then validates the client certificate chain and authorization policy. One-way server authentication, by contrast, authenticates only the server to the client and does not identify the customer. Mutual authentication authenticates both sides simultaneously; while it includes client authentication, it is broader than what the question asks. "End-to-end authentication" describes assurance between endpoints across intermediaries, but it is not the specific "customer authenticates to service" method in certificate-based terminology. Therefore, the best answer is one-way client authentication.
NEW QUESTION # 30
(How does adding salt to a password improve security?)
- A. Salt creates a different hash if two people use the same password.
- B. Salt ensures two people do not have the same password.
- C. Salt prevents users from reusing the same password.
- D. Salt enforces the complexity rules for passwords.
Answer: A
Explanation:
A salt is a unique, random value stored alongside a password hash and combined with the password during hashing. Its main security benefit is that it ensures identical passwords do not produce identical hashes across different accounts or systems. If two users choose the same password, their stored hashes will differ because their salts differ, which directly prevents attackers from spotting shared passwords by comparing hashes. Salts also defeat precomputation attacks such as rainbow tables, because an attacker would need to regenerate tables for each possible salt value-a task that becomes infeasible when salts are large and unique per password. Salt does not enforce password complexity rules (that's a policy/validation function), does not guarantee users choose different passwords, and does not prevent password reuse across sites. The correct statement is that salt makes the resulting hash different even for the same password, improving resistance to offline cracking at scale and eliminating the "same hash
= same password" shortcut attackers rely on.
NEW QUESTION # 31
(Which attack may take the longest amount of time to achieve success?)
- A. Rainbow table
- B. Birthday
- C. Brute-force
- D. Dictionary
Answer: C
Explanation:
A brute-force attack exhaustively tries every possible key or password candidate until the correct one is found. Because it explores the full search space (or a very large portion of it), brute force is often the slowest method, especially when strong keys, long passwords, rate limits, and slow password hashing (bcrypt/Argon2) are used. By contrast, a dictionary attack reduces work by trying only common or likely passwords, often succeeding quickly against weak human-chosen secrets. Rainbow table attacks shift work into precomputation; once a table exists, lookup can be faster than brute-force-though salt and modern hashing defeat them. Birthday attacks are about finding collisions, not necessarily recovering a specific secret, and their expected work is about 2^(n/2) for an n-bit hash, which can be less than brute-force key search in many contexts. Therefore, among the listed options, brute-force generally takes the longest to succeed because it makes the fewest assumptions and does the most total work.
NEW QUESTION # 32
(Which mechanism can be applied to protect the integrity of plaintext when using AES?)
- A. Message Authentication Code (MAC)
- B. RC4
- C. RSA
- D. Kerberos key sharing
Answer: A
Explanation:
AES by itself is a symmetric block cipher that provides confidentiality, but not guaranteed integrity unless used in an authenticated mode. To protect integrity of the plaintext (ensuring it has not been altered), a Message Authentication Code (MAC) can be applied. In the classic Encrypt-then-MAC pattern, the sender encrypts the plaintext with AES and then computes a MAC (often HMAC-SHA-256 or CMAC-AES) over the ciphertext (and relevant headers). The receiver verifies the MAC before attempting decryption, preventing tampering and many padding-oracle style vulnerabilities.
Alternatively, AES can be used in an AEAD mode like AES-GCM, which produces an authentication tag serving a similar purpose, but among the listed options the general integrity mechanism is "MAC." RC4 is an unrelated stream cipher and does not provide integrity. RSA is asymmetric and not the standard integrity add-on for AES-encrypted bulk data. Kerberos is an authentication protocol and key distribution system, not a message integrity primitive. Therefore, to protect plaintext integrity when using AES, the correct mechanism is a Message Authentication Code.
NEW QUESTION # 33
(Which encryption algorithm encrypts with one key, decrypts with another key, and then encrypts with the first key?)
- A. DES
- B. IDEA
- C. AES
- D. 3DES
Answer: D
Explanation:
3DES (Triple DES) commonly uses an Encrypt-Decrypt-Encrypt (EDE) sequence. In the two-key form, it encrypts with key K1, decrypts with key K2, then encrypts again with K1. In the three-key form, it encrypts with K1, decrypts with K2, then encrypts with K3. The EDE construction was chosen partly for backward compatibility: if K1=K2=K3, the scheme reduces to single DES, allowing older systems to interoperate in constrained ways. AES and IDEA do not use an EDE triple-stage process as their defining structure; they are single-pass block ciphers with internal rounds. DES is a single-pass algorithm (one key) rather than a triple application with multiple keys. Therefore, the algorithm described-encrypt with one key, decrypt with another, encrypt with the first-is 3DES. Although now considered legacy, it remains a classic example of increasing effective security by applying a block cipher multiple times with independent keys.
NEW QUESTION # 34
(What describes a true random number generator?)
- A. Unique integer determined through factorization of integers
- B. Fast and deterministic, and the same input produces the same results
- C. Integer increased by one to match requests and responses
- D. Slow and nondeterministic, and the same input produces different results
Answer: D
Explanation:
A true random number generator (TRNG) draws randomness from physical phenomena that are inherently unpredictable and not algorithmically reproducible. Because of this, it is nondeterministic:
you cannot feed it the same "input" and expect the same output stream. TRNGs are often slower than PRNGs because they depend on collecting entropy from hardware sources and may require conditioning to remove bias. This aligns with option B: slow and nondeterministic, producing different results even under similar or repeated conditions. Option A describes a deterministic PRNG, where identical seeds yield identical sequences. Option C is unrelated; factorization is a hard math problem used in cryptography (e.g., RSA security assumptions), not a randomness generator definition. Option D describes a counter, which is deterministic and not random. In secure systems, TRNG output may seed a cryptographically secure PRNG to provide both unpredictability and high throughput; but the defining characteristic of a TRNG is nondeterminism from physical entropy. Therefore, option B is correct.
NEW QUESTION # 35
(Which cryptographic operation has the fastest decryption process?)
- A. Symmetric
- B. Asymmetric
- C. Hashing
- D. Padding
Answer: A
Explanation:
Symmetric cryptography generally provides the fastest encryption and decryption performance among common cryptographic operations. Algorithms like AES and ChaCha20 are designed for high throughput and efficient implementation in software and hardware (e.g., AES-NI acceleration).
Symmetric decryption is computationally similar in cost to symmetric encryption, and both are far faster than asymmetric operations for equivalent security levels. Asymmetric cryptography (RSA, ECC) involves expensive mathematical operations (modular exponentiation or elliptic-curve scalar multiplication), making it much slower and unsuitable for bulk data decryption. That is why real-world secure protocols use asymmetric cryptography primarily to authenticate peers and establish keys, then switch to symmetric encryption for the actual data stream. Hashing is not decryption at all; it is one- way, and there is no "decrypt" operation for a hash. Padding is not a decryption mechanism; it is a formatting step used with block ciphers to align plaintext length. Therefore, the correct choice for the operation with the fastest decryption process is symmetric cryptography.
NEW QUESTION # 36
(A security engineer is implementing device authentication as a form of two-factor authentication in a Public Key Infrastructure (PKI) environment. What should be used as a second form of authentication?)
- A. Digital certificate
- B. Asymmetric encryption
- C. Digital signature
- D. Symmetric encryption
Answer: A
Explanation:
In a PKI environment, a digital certificate is the standard credential used to bind an identity (user, device, service) to a public key, with that binding vouched for by a Certificate Authority. For device authentication, the device typically proves possession of the private key corresponding to the certificate' s public key (for example, during a TLS handshake). As a second factor in a two-factor model, a certificate (often stored in a TPM, smart card, or secure enclave) represents "something you have"-a cryptographic credential anchored to hardware or a managed endpoint. The other listed options (symmetric encryption, asymmetric encryption, digital signature) are cryptographic operations or algorithm classes, not stand-alone authentication factors. A digital signature is a mechanism used within authentication flows, but it is not itself the credential that establishes an enrolled device identity within PKI. In practice, a certificate-based device factor is commonly paired with a knowledge factor (password/PIN) or a biometric factor to achieve true 2FA, but among these choices, the appropriate second form of authentication in PKI terms is the digital certificate.
NEW QUESTION # 37
(Which number of bits gets encrypted each time encryption is applied during stream encryption?)
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
In the classical definition, a stream cipher encrypts data in very small units-often described as one bit at a time-by combining plaintext with a keystream (commonly via XOR). While many practical stream ciphers operate on bytes or words for efficiency, the conceptual distinction compared to block ciphers is that stream encryption processes data as a continuous stream rather than fixed-size blocks.
This is why the standard teaching answer is "1 bit" per application of the keystream. Block ciphers, by contrast, encrypt blocks like 64 bits (DES/3DES) or 128 bits (AES) in each invocation of the block primitive. Options like 40, 192, and 256 are not typical stream cipher "per-step" processing sizes; 40 and 256 are often associated with key sizes, and 192 could be a key size for AES, not an encryption granularity. The essential security requirement for stream ciphers is that the keystream must be unpredictable and never reused with the same key/nonce combination; otherwise XOR properties allow attackers to recover relationships between plaintexts. Thus, the best answer is 1.
NEW QUESTION # 38
(What are the roles of keys when using digital signatures?)
- A. A private key is used for both signing and signature validation.
- B. A public key is used for signing, and a private key is used for signature validation.
- C. A private key is used for signing, and a public key is used for signature validation.
- D. A public key is used for both signing and signature validation.
Answer: C
Explanation:
Digital signatures provide integrity, authenticity, and typically non-repudiation by using an asymmetric key pair. The signer uses the private key to create a signature over a message (usually over a hash
/digest of the message). Because the private key is kept secret, only the legitimate signer should be able to produce a valid signature. Anyone who has the corresponding public key can then validate the signature: they verify that the signature matches the message digest under the public key and that the signed data has not been altered. This is why the public key can be widely distributed (often inside an X.
509 certificate) while the private key must be protected by the signer. If a public key were used to sign, anyone could forge signatures; if a private key were required for validation, only the signer could validate, defeating the purpose of public verifiability. Therefore, the correct key roles are private key for signing and public key for signature validation.
NEW QUESTION # 39
(Which encryption process sends a list of cipher suites that are supported for encrypted communications?)
- A. Integrity check
- B. Forward secrecy
- C. ClientHello
- D. ServerHello
Answer: C
Explanation:
In the TLS handshake, the ClientHello message is the client's opening negotiation message and includes the client's supported cryptographic capabilities. A key part of ClientHello is the offered cipher suites list, which advertises combinations of key exchange, authentication, encryption, and integrity/AEAD algorithms the client is willing to use. The server responds with ServerHello, selecting one of the offered cipher suites (in TLS 1.2 and earlier) and confirming protocol parameters. Forward secrecy is a property achieved by using ephemeral key exchange (e.g., (EC)DHE), not a specific message that "sends a list." "Integrity check" is a security goal/mechanism, not the negotiation step. While TLS 1.3 changes the structure of negotiation (cipher suite list still appears in ClientHello but only covers AEAD and hash; key exchange is negotiated via extensions), the fundamental idea remains: the client proposes supported cipher suites in ClientHello, and the server picks compatible parameters. Therefore, the process that sends the list of supported cipher suites is the ClientHello.
NEW QUESTION # 40
(How are limits managed for the number of bitcoins that can be created and stored in a blockchain?)
- A. A maximum has been established per country
- B. Each person has a maximum number
- C. The total number of participants has been set
- D. Rewards for mining reduce over time
Answer: D
Explanation:
Bitcoin's supply is controlled by protocol rules enforced by consensus: new bitcoins enter circulation through the block subsidy awarded to miners for producing valid blocks. This subsidy is programmed to halve at fixed intervals (every 210,000 blocks), which steadily reduces the rate of new coin creation over time and asymptotically approaches a capped total supply (commonly cited as 21 million BTC).
This mechanism is often called the halving schedule and is the primary way limits are managed. The number of participants is not fixed; anyone can run a node or mine. There is no per-country cap and no per-person maximum enforced by the protocol-addresses and ownership are not limited that way. The supply cap emerges from the decreasing issuance schedule combined with consensus validation rules that reject blocks creating coins beyond what the schedule allows. Therefore, the correct answer is that limits are managed because rewards for mining reduce over time.
NEW QUESTION # 41
......
Updated Exam Introduction-to-Cryptography Dumps with New Questions: https://www.realexamfree.com/Introduction-to-Cryptography-real-exam-dumps.html
Dumps to Pass your Introduction-to-Cryptography Exam with 100% Real Questions and Answers: https://drive.google.com/open?id=1H_jSfkAW08fG-IA_CjeuQIPjiIe5GPls
