Free Practice Quiz Question List

5 Cryptographic Key Management Online Quiz Questions

Use this free practice quiz with 20 questions to review 5 Cryptographic Key Management, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: A cryptographic hash function such as SHA-256 requires a secret key as part of its operation.

A
True
B
False

Fill in the blank

1 point

A key’s is the period during which it is authorized for use.

Written response

1 point

What term names the period during which a cryptographic key is authorized for use?

Choose one

1 point

A team is creating a key inventory. Which record is appropriate to include for each key?

A
The complete secret key material, so administrators can retrieve it from the inventory
B
The key’s identifier, type, purpose, owner, location, status, creation date, and rotation or expiration schedule
C
Only the key’s algorithm and secret material
D
The passwords of all users authorized to access the key

True or false

1 point

True or false: In public-key cryptography, the public key can generally be distributed openly, while the private key must be protected.

A
True
B
False

Fill in the blank

1 point

In envelope encryption, a DEK encrypts the data, while a separately protected KEK encrypts or wraps the .

Written response

1 point

What protected hardware system can generate sensitive keys so that raw key material need not leave the protected system?

Choose one

1 point

A service needs a new encryption key. Which method follows secure key-generation practice?

A
Type a string that looks random and adjust it until it seems sufficiently complex
B
Use a cryptographically secure random-number generator through a trusted cryptographic library or module
C
Reuse a long password and change a few characters
D
Modify an existing key so the new one is different

Choose all

1 point

A service suspects that one of its keys has been compromised. Which actions are appropriate? Select all that apply.

A
Promptly stop or restrict the compromised key’s use
B
Assume revocation makes any copies already obtained by an attacker disappear
C
Identify affected data and systems
D
Create replacement keys and investigate possible misuse
E
Continue normal use until the next scheduled rotation

Choose one

1 point

A storage system replaces a KEK that wraps several DEKs. What key-migration step is commonly required?

A
Re-wrap the DEKs under the new KEK
B
Re-encrypt all the data because changing any KEK always requires it
C
Leave the DEKs wrapped under the old KEK and discard that KEK immediately
D
Store the new KEK alongside each data item in ordinary configuration files

Choose all

1 point

A team is designing a safe key-backup and recovery process. Which practices should it adopt? Select all that apply.

A
Encrypt backups and use access controls separate from those for normal key use
B
Use secure, preferably independent storage and restrict who can restore backups
C
Allow any administrator to restore backups without logging the action
D
Log backup and recovery actions and test restoration procedures regularly
E
Assume a backup is safe even if nobody has tested whether it can be restored

True or false

1 point

True or false: Revoking a compromised key prevents an attacker from using any copies of that key that were already obtained.

A
True
B
False

Open ended

1 point

A storage system is planning two separate migrations: replacing the KEK that wraps its DEKs, and replacing a DEK that encrypts existing data. Explain what each migration generally requires and why.

Choose one

1 point

A team is creating an inventory for its encryption keys. Which entry follows secure key-management practice?

A
Store a copy of the secret key material so administrators can find it.
B
Record the key’s identifier, purpose, owner, status, and rotation or expiration schedule.
C
Record every application password associated with the key.
D
Use the inventory as the only place to store the key’s backup.

Choose one

1 point

A developer needs a new encryption key. Which approach best meets the key-generation guidance?

A
Type a long sequence of random-looking characters and use it as the key.
B
Reuse a strong password and change several characters.
C
Generate the key with a cryptographically secure random-number generator in a trusted cryptographic library.
D
Modify an existing key until it looks sufficiently different.

Choose one

1 point

In an envelope-encryption design, which description correctly assigns the roles of the data-encryption key (DEK) and key-encryption key (KEK)?

A
The DEK encrypts the data, and the KEK wraps the DEK.
B
The KEK encrypts the data, and the DEK wraps the KEK.
C
Both the DEK and KEK must be stored alongside the unencrypted data.
D
The DEK is a public key, while the KEK is its corresponding private key.

Written response

1 point

In envelope encryption, what is the name of the key that encrypts or wraps the data-encryption key?

Choose one

1 point

An organization is setting backup rules for encryption and private signing keys. Which policy best reflects secure recovery practice?

A
Back up every key automatically to a shared folder for convenience.
B
Avoid all key backups, even when losing an encryption key would make needed data unreadable.
C
Back up private signing keys by default because multiple copies improve signing availability.
D
Back up an encryption key when recovery is necessary and permitted, but avoid backing up a private signing key unless policy explicitly allows it.

Written response

1 point

What is the technical term for the period during which a key is authorized for use?

Choose one

1 point

A service is planning key rotation for data protected with envelope encryption. Which migration plan correctly distinguishes replacing a KEK from replacing a DEK used for existing data?

A
Replacing a KEK generally requires re-encrypting all data, while replacing a DEK only requires re-wrapping it.
B
Replacing a KEK often requires re-wrapping DEKs; replacing a DEK for existing data generally requires re-encrypting that data.
C
Replacing either key always requires deleting all protected data and starting over.
D
Replacing a DEK requires notifying a certificate authority, while replacing a KEK requires revoking a certificate.