1|Page
WGU D334 V1 PRE-ASSESSMENT INTRO
TO CRYPTOGRAPHY QUESTIONS 1–100
AND ANSWERS UPDATED 2026/2027 |
DETAILED RATIONALES | INSTANT
DOWNLOAD
Introduction
WGU D334 Intro to Cryptography introduces the fundamental principles, algorithms, protocols,
and security practices used to protect digital information. This practice question bank is designed
for students preparing for the D334 pre-assessment who want to strengthen their understanding
of cryptographic concepts and apply them to realistic cybersecurity scenarios.
Cryptography supports confidentiality, integrity, authentication, and nonrepudiation across
modern information systems. Understanding these concepts is essential when evaluating secure
communications, protecting stored information, managing cryptographic keys, and identifying
weaknesses in security implementations. The questions in this resource cover symmetric and
asymmetric encryption, hashing, digital signatures, public key infrastructure, certificates, key
exchange, cryptographic protocols, password protection, and common cryptographic attacks.
Each question includes four answer choices, one best answer, and a detailed rationale explaining
why the correct answer is appropriate and why the alternatives are incorrect. The scenarios
emphasize practical reasoning, algorithm selection, secure configuration, and identification of
cryptographic weaknesses. For the best results, answer every question before reading its
rationale, then revisit any missed concepts. These original practice questions are a supplementary
study resource, not official WGU assessment questions or a guarantee of a particular score.
Content Area Overview
Practice
Content area Questions Key topics
weight
Cryptographic foundations 1–10 CIA triad, security goals, terminology 10%
AES, block ciphers, modes, IVs,
Symmetric encryption 11–20 10%
nonces
Asymmetric cryptography 21–30 RSA, ECC, key pairs, key exchange 10%
SHA-2, salts, password hashing,
Hashing and password security 31–40 10%
collisions
Integrity and authentication 41–50 MACs, HMAC, digital signatures 10%
,2|Page
Certificate authorities, trust chains,
PKI and certificates 51–60 10%
revocation
TLS, secure communication, key
Cryptographic protocols 61–70 10%
negotiation
Generation, storage, rotation, backup,
Key management 71–80 10%
destruction
Brute force, replay, downgrade, side
Cryptographic attacks 81–90 10%
channels
Applied cryptography and Algorithm selection, configuration,
91–100 10%
troubleshooting incident analysis
The weights are an even practice allocation for this question bank, not an official WGU exam
blueprint.
QUESTIONS 1–100
Q1: A company encrypts confidential customer records before storing them. An
attacker obtains a copy of the encrypted database but does not possess the
decryption key. Which security objective is the encryption primarily intended to
protect?
A) Availability
B) Confidentiality
C) Nonrepudiation
D) Physical integrity
Rationale: B is correct because confidentiality prevents unauthorized parties from learning
protected information. Encryption transforms readable plaintext into ciphertext that should be
computationally infeasible to recover without the appropriate key. A is incorrect because
availability concerns whether authorized users can access systems and data when needed. C is
incorrect because nonrepudiation provides evidence supporting the origin of an action or
message. D is incorrect because encryption does not physically protect storage devices from
damage.
Q2: A software vendor distributes a digitally signed update. A customer verifies
the signature successfully but discovers that the update contains a vulnerable
feature. What does successful signature verification establish most directly?
A) The software is free from vulnerabilities
B) The software will always be available
C) The software cannot contain malicious code
D) The signed content matches the content authenticated by the corresponding signing key
,3|Page
Rationale: D is correct because signature verification establishes that the signed data matches
the signature and that the signature verifies under the relevant public key. Trust in the identity
behind that key depends on the surrounding certificate or key-distribution process. A is incorrect
because signatures do not prove software is vulnerability-free. B is incorrect because a signature
does not guarantee availability. C is incorrect because a legitimate signer can sign malicious or
vulnerable software.
Q3: An organization encrypts files using a strong algorithm, but several
administrators share one unrestricted decryption key. One administrator leaves
the company and may have retained a copy. Which weakness is most significant?
A) The encryption algorithm necessarily has a mathematical flaw
B) Encryption automatically guarantees accountability
C) Poor key management undermines the protection provided by the algorithm
D) The ciphertext must be plaintext because several people can decrypt it
Rationale: C is correct because secure cryptography depends on protecting keys, limiting access,
and revoking or rotating compromised credentials. A is incorrect because poor key management
does not demonstrate that the algorithm itself is broken. B is incorrect because sharing one key
can reduce accountability rather than guarantee it. D is incorrect because authorized key
holders can decrypt ciphertext without making the ciphertext itself plaintext.
Q4: A security analyst must protect a message against unauthorized reading and
detect any unauthorized modification. Which design best addresses both
requirements?
A) Base64 encoding alone
B) Compression without encryption
C) Authenticated encryption using an appropriate mode such as AES-GCM
D) A checksum that is transmitted openly beside the message
Rationale: C is correct because authenticated encryption provides confidentiality and an
integrity/authenticity check when used correctly with secure keys and unique nonces as required
by the mode. A is incorrect because Base64 is encoding, not encryption. B is incorrect because
compression does not provide cryptographic protection. D is incorrect because an attacker may
modify the message and recompute an unkeyed checksum.
Q5: A developer claims that a longer encryption key automatically makes an
insecure algorithm safe. Which assessment is most accurate?
A) Any algorithm becomes secure if its key is sufficiently long
B) Security depends on the algorithm, key size, implementation, and key handling together
C) Key size has no effect on resistance to brute-force attacks
D) The algorithm name alone proves that the system is secure
, 4|Page
Rationale: B is correct because overall security depends on the cryptographic primitive,
appropriate parameters, implementation quality, and key protection. A is incorrect because a
large key cannot repair fundamental design flaws or insecure modes. C is incorrect because key
size affects the effort required for exhaustive key search. D is incorrect because a reputable
algorithm can still be implemented or configured insecurely.
Q6: A web application stores passwords using reversible encryption so
administrators can retrieve forgotten passwords. Which change is the most
appropriate?
A) Publish the decryption key so users can recover passwords themselves
B) Replace the encryption with Base64 encoding
C) Use a single fast hash without a salt for every account
D) Store salted password hashes using a purpose-built password-hashing function
Rationale: D is correct because password storage should use a one-way, salted password-
hashing scheme such as Argon2id, scrypt, or an appropriately configured bcrypt or PBKDF2
implementation. A is incorrect because publishing the key exposes every encrypted password. B
is incorrect because Base64 is reversible encoding. C is incorrect because fast unsalted hashes
make large-scale offline guessing easier and allow identical passwords to produce identical
stored hashes.
Q7: Two users need to exchange encrypted information over a public network.
They have not previously shared a secret key. Which cryptographic approach
can help them establish a shared secret over the insecure channel?
A) A public checksum without any key exchange
B) Plaintext transmission of the intended secret
C) An authenticated key-establishment protocol using an appropriate public-key method
D) Compression followed by Base64 encoding
Rationale: C is correct because authenticated key establishment, often using ephemeral Diffie–
Hellman or elliptic-curve Diffie–Hellman within a secure protocol, can establish a shared secret
without sending that secret directly. Authentication is needed to prevent man-in-the-middle
attacks. A is incorrect because a checksum does not establish a secret. B is insecure because the
secret can be intercepted. D provides neither encryption nor authentication.
Q8: A company wants to demonstrate that a message has not changed since it
was created. Which property is most directly relevant?
A) Availability
B) Confidentiality
C) Integrity
D) Compression efficiency
WGU D334 V1 PRE-ASSESSMENT INTRO
TO CRYPTOGRAPHY QUESTIONS 1–100
AND ANSWERS UPDATED 2026/2027 |
DETAILED RATIONALES | INSTANT
DOWNLOAD
Introduction
WGU D334 Intro to Cryptography introduces the fundamental principles, algorithms, protocols,
and security practices used to protect digital information. This practice question bank is designed
for students preparing for the D334 pre-assessment who want to strengthen their understanding
of cryptographic concepts and apply them to realistic cybersecurity scenarios.
Cryptography supports confidentiality, integrity, authentication, and nonrepudiation across
modern information systems. Understanding these concepts is essential when evaluating secure
communications, protecting stored information, managing cryptographic keys, and identifying
weaknesses in security implementations. The questions in this resource cover symmetric and
asymmetric encryption, hashing, digital signatures, public key infrastructure, certificates, key
exchange, cryptographic protocols, password protection, and common cryptographic attacks.
Each question includes four answer choices, one best answer, and a detailed rationale explaining
why the correct answer is appropriate and why the alternatives are incorrect. The scenarios
emphasize practical reasoning, algorithm selection, secure configuration, and identification of
cryptographic weaknesses. For the best results, answer every question before reading its
rationale, then revisit any missed concepts. These original practice questions are a supplementary
study resource, not official WGU assessment questions or a guarantee of a particular score.
Content Area Overview
Practice
Content area Questions Key topics
weight
Cryptographic foundations 1–10 CIA triad, security goals, terminology 10%
AES, block ciphers, modes, IVs,
Symmetric encryption 11–20 10%
nonces
Asymmetric cryptography 21–30 RSA, ECC, key pairs, key exchange 10%
SHA-2, salts, password hashing,
Hashing and password security 31–40 10%
collisions
Integrity and authentication 41–50 MACs, HMAC, digital signatures 10%
,2|Page
Certificate authorities, trust chains,
PKI and certificates 51–60 10%
revocation
TLS, secure communication, key
Cryptographic protocols 61–70 10%
negotiation
Generation, storage, rotation, backup,
Key management 71–80 10%
destruction
Brute force, replay, downgrade, side
Cryptographic attacks 81–90 10%
channels
Applied cryptography and Algorithm selection, configuration,
91–100 10%
troubleshooting incident analysis
The weights are an even practice allocation for this question bank, not an official WGU exam
blueprint.
QUESTIONS 1–100
Q1: A company encrypts confidential customer records before storing them. An
attacker obtains a copy of the encrypted database but does not possess the
decryption key. Which security objective is the encryption primarily intended to
protect?
A) Availability
B) Confidentiality
C) Nonrepudiation
D) Physical integrity
Rationale: B is correct because confidentiality prevents unauthorized parties from learning
protected information. Encryption transforms readable plaintext into ciphertext that should be
computationally infeasible to recover without the appropriate key. A is incorrect because
availability concerns whether authorized users can access systems and data when needed. C is
incorrect because nonrepudiation provides evidence supporting the origin of an action or
message. D is incorrect because encryption does not physically protect storage devices from
damage.
Q2: A software vendor distributes a digitally signed update. A customer verifies
the signature successfully but discovers that the update contains a vulnerable
feature. What does successful signature verification establish most directly?
A) The software is free from vulnerabilities
B) The software will always be available
C) The software cannot contain malicious code
D) The signed content matches the content authenticated by the corresponding signing key
,3|Page
Rationale: D is correct because signature verification establishes that the signed data matches
the signature and that the signature verifies under the relevant public key. Trust in the identity
behind that key depends on the surrounding certificate or key-distribution process. A is incorrect
because signatures do not prove software is vulnerability-free. B is incorrect because a signature
does not guarantee availability. C is incorrect because a legitimate signer can sign malicious or
vulnerable software.
Q3: An organization encrypts files using a strong algorithm, but several
administrators share one unrestricted decryption key. One administrator leaves
the company and may have retained a copy. Which weakness is most significant?
A) The encryption algorithm necessarily has a mathematical flaw
B) Encryption automatically guarantees accountability
C) Poor key management undermines the protection provided by the algorithm
D) The ciphertext must be plaintext because several people can decrypt it
Rationale: C is correct because secure cryptography depends on protecting keys, limiting access,
and revoking or rotating compromised credentials. A is incorrect because poor key management
does not demonstrate that the algorithm itself is broken. B is incorrect because sharing one key
can reduce accountability rather than guarantee it. D is incorrect because authorized key
holders can decrypt ciphertext without making the ciphertext itself plaintext.
Q4: A security analyst must protect a message against unauthorized reading and
detect any unauthorized modification. Which design best addresses both
requirements?
A) Base64 encoding alone
B) Compression without encryption
C) Authenticated encryption using an appropriate mode such as AES-GCM
D) A checksum that is transmitted openly beside the message
Rationale: C is correct because authenticated encryption provides confidentiality and an
integrity/authenticity check when used correctly with secure keys and unique nonces as required
by the mode. A is incorrect because Base64 is encoding, not encryption. B is incorrect because
compression does not provide cryptographic protection. D is incorrect because an attacker may
modify the message and recompute an unkeyed checksum.
Q5: A developer claims that a longer encryption key automatically makes an
insecure algorithm safe. Which assessment is most accurate?
A) Any algorithm becomes secure if its key is sufficiently long
B) Security depends on the algorithm, key size, implementation, and key handling together
C) Key size has no effect on resistance to brute-force attacks
D) The algorithm name alone proves that the system is secure
, 4|Page
Rationale: B is correct because overall security depends on the cryptographic primitive,
appropriate parameters, implementation quality, and key protection. A is incorrect because a
large key cannot repair fundamental design flaws or insecure modes. C is incorrect because key
size affects the effort required for exhaustive key search. D is incorrect because a reputable
algorithm can still be implemented or configured insecurely.
Q6: A web application stores passwords using reversible encryption so
administrators can retrieve forgotten passwords. Which change is the most
appropriate?
A) Publish the decryption key so users can recover passwords themselves
B) Replace the encryption with Base64 encoding
C) Use a single fast hash without a salt for every account
D) Store salted password hashes using a purpose-built password-hashing function
Rationale: D is correct because password storage should use a one-way, salted password-
hashing scheme such as Argon2id, scrypt, or an appropriately configured bcrypt or PBKDF2
implementation. A is incorrect because publishing the key exposes every encrypted password. B
is incorrect because Base64 is reversible encoding. C is incorrect because fast unsalted hashes
make large-scale offline guessing easier and allow identical passwords to produce identical
stored hashes.
Q7: Two users need to exchange encrypted information over a public network.
They have not previously shared a secret key. Which cryptographic approach
can help them establish a shared secret over the insecure channel?
A) A public checksum without any key exchange
B) Plaintext transmission of the intended secret
C) An authenticated key-establishment protocol using an appropriate public-key method
D) Compression followed by Base64 encoding
Rationale: C is correct because authenticated key establishment, often using ephemeral Diffie–
Hellman or elliptic-curve Diffie–Hellman within a secure protocol, can establish a shared secret
without sending that secret directly. Authentication is needed to prevent man-in-the-middle
attacks. A is incorrect because a checksum does not establish a secret. B is insecure because the
secret can be intercepted. D provides neither encryption nor authentication.
Q8: A company wants to demonstrate that a message has not changed since it
was created. Which property is most directly relevant?
A) Availability
B) Confidentiality
C) Integrity
D) Compression efficiency
