712-50 Question 336
Single answerIdentify the different components of a cryptosystemA global financial services company is redesigning its customer document portal to protect sensitive statements in transit and at rest. During an architecture review, the CISO asks the team to verify that the proposed design includes all essential components of a cryptosystem rather than focusing only on encryption software. The design notes mention: AES-256 for file encryption, a hardware security module (HSM) for key protection, a process for rotating and revoking keys, and the original customer statements before encryption. Which option BEST identifies the full set of cryptosystem components represented in this design?
- A
Plaintext, encryption algorithm, cryptographic keys, and key management
- B
Ciphertext, firewall rules, endpoint agents, and digital certificates
- C
Hash values, data loss prevention policies, tokenization, and compression
- D
Encryption algorithm, SIEM correlation rules, backup retention schedule, and network segmentation
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because a cryptosystem must be understood as a complete system for protecting information, not merely the encryption algorithm. In practical enterprise governance, the primary components include the plaintext or input data, the cryptographic algorithm, the keys used by that algorithm, and the key management processes that control key generation, storage, distribution, rotation, revocation, recovery, and destruction. In the scenario, the original statements are plaintext, AES-256 is the algorithm, the HSM supports secure key storage and protection, and the rotation/revocation process represents key management. This aligns with widely accepted security guidance such as NIST cryptographic and key management publications, including NIST SP 800-57 for key management principles and NIST guidance on validated cryptographic modules and lifecycle controls. From a CCISO perspective, the governance lesson is that selecting a strong algorithm is insufficient if key management is weak; organizational risk is often driven more by poor key lifecycle management than by the cipher choice itself.
- A. Correct.
Correct. A cryptosystem is not just the cipher; it includes the plaintext being protected, the algorithm used to transform it, the cryptographic keys, and the processes or mechanisms that manage those keys throughout their lifecycle. In the scenario, the customer statements are the plaintext, AES-256 is the encryption algorithm, the HSM protects the keys, and rotation/revocation are part of key management. This reflects how cryptosystems are evaluated in practice: the strength of the overall system depends heavily on key generation, storage, distribution, rotation, and destruction, not only on the algorithm.
- B. Incorrect.
Incorrect. Ciphertext is an output of encryption, not a foundational component set that fully describes the cryptosystem in this scenario. Firewall rules and endpoint agents are security controls, but they are not core cryptosystem components. Digital certificates may support public key infrastructures and authentication, but they do not replace the need to identify plaintext, algorithm, keys, and key management. A candidate might choose this option by confusing supporting security controls with the cryptosystem itself.
- C. Incorrect.
Incorrect. Hash values and tokenization are distinct data protection techniques, and compression is a data handling function, not a core cryptosystem component. Data loss prevention policies are governance controls, not cryptographic building blocks. This option is plausible because these technologies often appear in enterprise data protection programs, but they do not describe the essential parts of the cryptosystem outlined in the scenario.
- D. Incorrect.
Incorrect. The encryption algorithm is a valid cryptosystem component, but SIEM rules, backup retention schedules, and network segmentation are operational or architectural controls rather than cryptographic components. Someone might choose this option because these controls improve the security posture around encrypted systems, but they do not define the cryptosystem itself.