1|Page
WGU D334 INTRO TO CRYPTOGRAPHY
PRE-ASSESSMENT BUNDLED
QUESTIONS AND CORRECT ANSWERS
PLUS RATIONALE | QUESTION 1-100 |
UPDATED 2026/2027 | DETAILED
RATIONALES | INSTANT DOWNLOAD
INTRODUCTION
WGU D334: Introduction to Cryptography introduces students to the principles, algorithms,
protocols, and security practices used to protect information in modern computing environments.
This practice question bank is designed for students preparing for cryptography-related
assessments who want to strengthen their understanding of encryption, hashing, digital
signatures, public-key infrastructure (PKI), key management, authentication, and secure
communications.
Cryptography is essential to cybersecurity because it supports confidentiality, integrity,
authentication, and nonrepudiation. Understanding these concepts helps security professionals
evaluate threats, select appropriate cryptographic controls, and recognize weaknesses in real-
world systems. Students may encounter scenario-based questions requiring them to distinguish
symmetric from asymmetric encryption, select suitable hashing or signature mechanisms,
interpret certificate problems, and identify insecure implementations.
This resource contains original, challenging multiple-choice practice questions with four answer
options and detailed rationales. The questions emphasize practical application, problem-solving,
and distinguishing between similar cryptographic concepts rather than memorizing definitions
alone. Use the explanations to identify knowledge gaps, review why alternative answers are
unsuitable, and build confidence before attempting your assessment. Work through the questions
independently first, then study each rationale carefully. This is an independent study resource,
not an official WGU assessment or a reproduction of secure examination questions. Review your
current course materials to confirm the precise objectives and terminology emphasized in your
version of D334.
CONTENT AREA OVERVIEW
Indicative
Content area Questions Key topics
weight
CIA triad, security goals, threat models,
Cryptographic foundations 1–10 10%
Kerckhoffs’s principle
,2|Page
Symmetric encryption and AES, block ciphers, stream ciphers, CBC,
11–22 12%
modes CTR, GCM, IVs and nonces
Public/private keys, RSA, elliptic-curve
Asymmetric cryptography 23–32 10%
cryptography, key exchange
Hashing and password SHA-2, SHA-3, collisions, salting,
33–42 10%
protection password hashing, HMAC
Signatures, certificates, certificate
Digital signatures and PKI 43–54 12%
authorities, revocation, trust chains
Key management and Generation, storage, rotation, escrow,
55–64 10%
lifecycle compromise, destruction
TLS, secure channels, handshakes,
Cryptographic protocols 65–76 12%
forward secrecy, certificate validation
Authentication and applied MFA, challenge-response, tokens, secure
77–86 10%
cryptography storage, cryptographic misuse
Cryptanalysis and Brute force, side channels, downgrade
87–94 8%
implementation risks attacks, nonce reuse, weak randomness
Cryptographic governance Algorithm selection, compliance,
95–100 6%
and selection migration, risk-based decisions
The weights above are a suggested study allocation for this practice bank, not official WGU
exam-domain percentages.
QUESTIONS 1–100
Cryptographic foundations
Q1. A company encrypts its customer database using a modern algorithm. An attacker steals the
database and reads the encrypted records but cannot recover the original information. Later, the
attacker changes a record in the database, and the application accepts the altered record without
detecting the change. Which security property is most clearly missing?
A) Confidentiality
B) Integrity
C) Availability
D) Nonrepudiation
Rationale: B is correct because integrity controls detect unauthorized alteration of data.
Encryption can provide confidentiality without automatically providing integrity, depending on
the algorithm and mode used. A is incorrect because the attacker could not recover the plaintext,
suggesting confidentiality remained effective. C is incorrect because the scenario does not
describe a service interruption or inability to access data. D is incorrect because nonrepudiation
concerns evidence that supports attributing an action to a party; it is not the primary property
violated by undetected record modification.
,3|Page
Q2. A security architect argues that a proprietary encryption algorithm is secure because its
design is secret. The encryption key is stored separately, but researchers eventually obtain a copy
of the algorithm and discover a weakness. Which principle was most directly violated by the
architect’s original security assumption?
A) Least privilege
B) Separation of duties
C) Kerckhoffs’s principle
D) Defense in depth
Rationale: C is correct because Kerckhoffs’s principle states that a cryptographic system should
remain secure even when its design is public, provided the key remains secret. A concerns
limiting permissions. B concerns dividing sensitive responsibilities among different individuals
or roles. D involves using multiple complementary safeguards. A secret design may add
obscurity, but relying on it as the primary protection is not a sound cryptographic strategy.
Q3. An organization must protect transaction records against unauthorized reading and
unauthorized modification while they travel across an untrusted network. Which design most
directly addresses both requirements?
A) Base64-encode every transaction before transmission
B) Encrypt transactions using a mode that provides confidentiality only
C) Hash each transaction with an unkeyed hash and transmit the hash separately
D) Use an authenticated encryption scheme with securely managed keys and nonces
Rationale: D is correct because authenticated encryption, such as AES-GCM when implemented
correctly, provides confidentiality and integrity/authenticity checks for encrypted data. A is
incorrect because Base64 is encoding, not encryption. B provides confidentiality but does not
inherently detect modification. C is insufficient when an attacker can alter both the message and
its separately transmitted unkeyed hash. An attacker can compute a new hash for the modified
message.
Q4. A developer proposes using a 256-bit encryption key but chooses a cipher mode that reuses
the same initialization value for every message. Why can this still create a serious security
weakness?
A) A 256-bit key is too long for modern cryptographic systems
B) Improper mode or nonce use can expose relationships between messages or enable
forgery, depending on the mode
C) Initialization values must always be encrypted with the same key
D) Reusing an initialization value automatically reveals the private key in every encryption mode
Rationale: B is correct because security depends on both the algorithm and its correct use.
Reusing a nonce or IV can be catastrophic in some modes, including CTR and GCM, while
consequences differ for other modes. A is incorrect because 256-bit keys are supported by
modern algorithms such as AES-256. C is incorrect because IVs and nonces are not universally
, 4|Page
required to be encrypted; their requirements depend on the construction. D overstates the effect:
reuse does not automatically reveal a key in every mode, although it can severely compromise
security.
Q5. An organization needs to ensure that a message came from an authorized sender and was not
altered in transit. The parties share a secret key and do not need public verification by third
parties. Which mechanism is the best fit?
A) An unkeyed SHA-256 digest
B) Symmetric encryption without authentication
C) A message authentication code (MAC), such as HMAC
D) Base64 encoding
Rationale: C is correct because a MAC uses a secret key to authenticate a message and detect
unauthorized modification. HMAC is a widely used construction based on a cryptographic hash
function. A is incorrect because an attacker can change a message and calculate a new unkeyed
digest. B does not necessarily authenticate the sender or protect integrity. D only changes data
representation and provides no cryptographic security.
Q6. A system must prove that a specific person approved a document in a way that another party
can independently verify using a public key. Which mechanism is most appropriate?
A) A shared-key MAC
B) A salted password hash
C) AES encryption alone
D) A digital signature created with the signer’s private key and verified with the
corresponding public key
Rationale: D is correct because digital signatures support public verification of message
authenticity and integrity, and can contribute to nonrepudiation when identity binding, key
control, and operational procedures are reliable. A is incorrect because all holders of a shared
MAC key can generate valid MACs, so an outside verifier cannot distinguish which holder
created one. B protects password storage rather than document approval. C provides
confidentiality but does not, by itself, prove who approved a document.
Q7. A company encrypts files on employee laptops but stores the decryption keys in plaintext in
the same directory as the encrypted files. An attacker gains ordinary file access and retrieves
both. What is the principal design flaw?
A) The encryption algorithm must always be asymmetric
B) Key protection is inadequate, undermining the security of the encrypted data
C) Encrypted files cannot be stored on laptops
D) The keys should be replaced with unkeyed hashes of the files
Rationale: B is correct because confidentiality depends on protecting the keys as well as
choosing a sound algorithm. If an attacker obtains both ciphertext and the corresponding
WGU D334 INTRO TO CRYPTOGRAPHY
PRE-ASSESSMENT BUNDLED
QUESTIONS AND CORRECT ANSWERS
PLUS RATIONALE | QUESTION 1-100 |
UPDATED 2026/2027 | DETAILED
RATIONALES | INSTANT DOWNLOAD
INTRODUCTION
WGU D334: Introduction to Cryptography introduces students to the principles, algorithms,
protocols, and security practices used to protect information in modern computing environments.
This practice question bank is designed for students preparing for cryptography-related
assessments who want to strengthen their understanding of encryption, hashing, digital
signatures, public-key infrastructure (PKI), key management, authentication, and secure
communications.
Cryptography is essential to cybersecurity because it supports confidentiality, integrity,
authentication, and nonrepudiation. Understanding these concepts helps security professionals
evaluate threats, select appropriate cryptographic controls, and recognize weaknesses in real-
world systems. Students may encounter scenario-based questions requiring them to distinguish
symmetric from asymmetric encryption, select suitable hashing or signature mechanisms,
interpret certificate problems, and identify insecure implementations.
This resource contains original, challenging multiple-choice practice questions with four answer
options and detailed rationales. The questions emphasize practical application, problem-solving,
and distinguishing between similar cryptographic concepts rather than memorizing definitions
alone. Use the explanations to identify knowledge gaps, review why alternative answers are
unsuitable, and build confidence before attempting your assessment. Work through the questions
independently first, then study each rationale carefully. This is an independent study resource,
not an official WGU assessment or a reproduction of secure examination questions. Review your
current course materials to confirm the precise objectives and terminology emphasized in your
version of D334.
CONTENT AREA OVERVIEW
Indicative
Content area Questions Key topics
weight
CIA triad, security goals, threat models,
Cryptographic foundations 1–10 10%
Kerckhoffs’s principle
,2|Page
Symmetric encryption and AES, block ciphers, stream ciphers, CBC,
11–22 12%
modes CTR, GCM, IVs and nonces
Public/private keys, RSA, elliptic-curve
Asymmetric cryptography 23–32 10%
cryptography, key exchange
Hashing and password SHA-2, SHA-3, collisions, salting,
33–42 10%
protection password hashing, HMAC
Signatures, certificates, certificate
Digital signatures and PKI 43–54 12%
authorities, revocation, trust chains
Key management and Generation, storage, rotation, escrow,
55–64 10%
lifecycle compromise, destruction
TLS, secure channels, handshakes,
Cryptographic protocols 65–76 12%
forward secrecy, certificate validation
Authentication and applied MFA, challenge-response, tokens, secure
77–86 10%
cryptography storage, cryptographic misuse
Cryptanalysis and Brute force, side channels, downgrade
87–94 8%
implementation risks attacks, nonce reuse, weak randomness
Cryptographic governance Algorithm selection, compliance,
95–100 6%
and selection migration, risk-based decisions
The weights above are a suggested study allocation for this practice bank, not official WGU
exam-domain percentages.
QUESTIONS 1–100
Cryptographic foundations
Q1. A company encrypts its customer database using a modern algorithm. An attacker steals the
database and reads the encrypted records but cannot recover the original information. Later, the
attacker changes a record in the database, and the application accepts the altered record without
detecting the change. Which security property is most clearly missing?
A) Confidentiality
B) Integrity
C) Availability
D) Nonrepudiation
Rationale: B is correct because integrity controls detect unauthorized alteration of data.
Encryption can provide confidentiality without automatically providing integrity, depending on
the algorithm and mode used. A is incorrect because the attacker could not recover the plaintext,
suggesting confidentiality remained effective. C is incorrect because the scenario does not
describe a service interruption or inability to access data. D is incorrect because nonrepudiation
concerns evidence that supports attributing an action to a party; it is not the primary property
violated by undetected record modification.
,3|Page
Q2. A security architect argues that a proprietary encryption algorithm is secure because its
design is secret. The encryption key is stored separately, but researchers eventually obtain a copy
of the algorithm and discover a weakness. Which principle was most directly violated by the
architect’s original security assumption?
A) Least privilege
B) Separation of duties
C) Kerckhoffs’s principle
D) Defense in depth
Rationale: C is correct because Kerckhoffs’s principle states that a cryptographic system should
remain secure even when its design is public, provided the key remains secret. A concerns
limiting permissions. B concerns dividing sensitive responsibilities among different individuals
or roles. D involves using multiple complementary safeguards. A secret design may add
obscurity, but relying on it as the primary protection is not a sound cryptographic strategy.
Q3. An organization must protect transaction records against unauthorized reading and
unauthorized modification while they travel across an untrusted network. Which design most
directly addresses both requirements?
A) Base64-encode every transaction before transmission
B) Encrypt transactions using a mode that provides confidentiality only
C) Hash each transaction with an unkeyed hash and transmit the hash separately
D) Use an authenticated encryption scheme with securely managed keys and nonces
Rationale: D is correct because authenticated encryption, such as AES-GCM when implemented
correctly, provides confidentiality and integrity/authenticity checks for encrypted data. A is
incorrect because Base64 is encoding, not encryption. B provides confidentiality but does not
inherently detect modification. C is insufficient when an attacker can alter both the message and
its separately transmitted unkeyed hash. An attacker can compute a new hash for the modified
message.
Q4. A developer proposes using a 256-bit encryption key but chooses a cipher mode that reuses
the same initialization value for every message. Why can this still create a serious security
weakness?
A) A 256-bit key is too long for modern cryptographic systems
B) Improper mode or nonce use can expose relationships between messages or enable
forgery, depending on the mode
C) Initialization values must always be encrypted with the same key
D) Reusing an initialization value automatically reveals the private key in every encryption mode
Rationale: B is correct because security depends on both the algorithm and its correct use.
Reusing a nonce or IV can be catastrophic in some modes, including CTR and GCM, while
consequences differ for other modes. A is incorrect because 256-bit keys are supported by
modern algorithms such as AES-256. C is incorrect because IVs and nonces are not universally
, 4|Page
required to be encrypted; their requirements depend on the construction. D overstates the effect:
reuse does not automatically reveal a key in every mode, although it can severely compromise
security.
Q5. An organization needs to ensure that a message came from an authorized sender and was not
altered in transit. The parties share a secret key and do not need public verification by third
parties. Which mechanism is the best fit?
A) An unkeyed SHA-256 digest
B) Symmetric encryption without authentication
C) A message authentication code (MAC), such as HMAC
D) Base64 encoding
Rationale: C is correct because a MAC uses a secret key to authenticate a message and detect
unauthorized modification. HMAC is a widely used construction based on a cryptographic hash
function. A is incorrect because an attacker can change a message and calculate a new unkeyed
digest. B does not necessarily authenticate the sender or protect integrity. D only changes data
representation and provides no cryptographic security.
Q6. A system must prove that a specific person approved a document in a way that another party
can independently verify using a public key. Which mechanism is most appropriate?
A) A shared-key MAC
B) A salted password hash
C) AES encryption alone
D) A digital signature created with the signer’s private key and verified with the
corresponding public key
Rationale: D is correct because digital signatures support public verification of message
authenticity and integrity, and can contribute to nonrepudiation when identity binding, key
control, and operational procedures are reliable. A is incorrect because all holders of a shared
MAC key can generate valid MACs, so an outside verifier cannot distinguish which holder
created one. B protects password storage rather than document approval. C provides
confidentiality but does not, by itself, prove who approved a document.
Q7. A company encrypts files on employee laptops but stores the decryption keys in plaintext in
the same directory as the encrypted files. An attacker gains ordinary file access and retrieves
both. What is the principal design flaw?
A) The encryption algorithm must always be asymmetric
B) Key protection is inadequate, undermining the security of the encrypted data
C) Encrypted files cannot be stored on laptops
D) The keys should be replaced with unkeyed hashes of the files
Rationale: B is correct because confidentiality depends on protecting the keys as well as
choosing a sound algorithm. If an attacker obtains both ciphertext and the corresponding
