1|Page
WGU D334 INTRO TO CRYPTOGRAPHY
PA QUESTIONS AND CORRECT
ANSWERS PLUS RATIONALE (ALREADY
GRADED A+) | QUESTION 1–100 |
UPDATED 2026/2027 | DETAILED
RATIONALES | INSTANT DOWNLOAD
INTRODUCTION
WGU D334: Introduction to Cryptography focuses on the cryptographic principles and
techniques used to protect sensitive information, secure digital communications, authenticate
users and systems, and maintain data integrity. This practice question bank is designed for
students preparing for a pre-assessment (PA) who want to strengthen their understanding of core
cryptographic concepts and apply them to practical cybersecurity scenarios.
The subject is important because modern organizations depend on encryption, hashing, digital
signatures, key management, and secure communication protocols to defend against
unauthorized access, tampering, impersonation, and data exposure. Students must understand not
only how cryptographic mechanisms work, but also when to select them, how to implement them
safely, and why seemingly strong systems can fail through poor key handling or protocol
configuration.
This resource provides original multiple-choice practice questions with four options per question
and detailed rationales. The scenarios emphasize analytical reasoning, risk identification,
troubleshooting, and selecting suitable security controls. For the best results, answer each
question before reviewing its explanation, then revisit the concepts you missed. Use the bank
alongside your current course materials to prepare for the assessment and identify areas requiring
additional study. This is an independent study resource, not an official WGU assessment or a
guarantee of a particular grade.
CONTENT AREA OVERVIEW
Suggested
Content area Questions Key topics
study weight
Confidentiality, integrity, authentication,
Cryptographic principles 1–10 10%
nonrepudiation, Kerckhoffs’s principle
AES, block and stream ciphers, modes,
Symmetric cryptography 11–20 10%
IVs, nonces, authenticated encryption
,2|Page
Asymmetric RSA, ECC, public/private keys, key
21–30 10%
cryptography agreement, hybrid encryption
Hashing and password SHA-2, collisions, HMAC, salts,
31–40 10%
security password-hashing functions
Digital signatures and Certificates, certificate authorities, trust
41–50 10%
PKI chains, validation, revocation
Generation, storage, rotation, backup,
Key management 51–60 10%
compromise, destruction
TLS, certificate validation, forward
Secure protocols 61–70 10%
secrecy, downgrade and replay attacks
Authentication, secure storage, message
Applied cryptography 71–80 10%
protection, cryptographic applications
Cryptanalysis and Brute force, side channels, nonce reuse,
81–90 10%
implementation risks weak randomness, padding oracles
Algorithm selection, migration, risk
Security decisions and
91–100 analysis, lifecycle and operational 10%
governance
controls
These percentages are suggested for study planning and are not official WGU assessment
weights.
QUESTIONS 1–100
Cryptographic principles
Q1. A financial application encrypts customer records before storing them in a database. An
attacker steals the database but cannot decrypt the records. However, the attacker changes an
account balance, and the application accepts the modified value. Which security requirement was
not adequately addressed?
A) Confidentiality
B) Integrity
C) Availability
D) Authentication
Rationale: B is correct because integrity protects against unauthorized modification and helps
ensure data has not been altered without detection. Encryption alone may provide confidentiality
without integrity. A is incorrect because the attacker could not decrypt the records, indicating
confidentiality remained effective. C concerns whether systems and information are accessible
when needed. D concerns verifying an identity or source and does not, by itself, ensure stored
records cannot be modified.
Q2. A software company relies on a proprietary encryption algorithm that has never been
independently reviewed. After an attacker obtains a copy of the algorithm, researchers identify a
,3|Page
weakness that makes encrypted data recoverable. Which principle would have discouraged
relying on secrecy of the algorithm itself?
A) Least privilege
B) Separation of duties
C) Kerckhoffs’s principle
D) Data minimization
Rationale: C is correct because Kerckhoffs’s principle holds that a cryptographic system should
remain secure even if its design is public, provided secret keys remain protected. A limits users’
permissions. B divides sensitive tasks among different people or roles. D limits unnecessary
collection or retention of data. None of these replaces the principle that cryptographic security
should not depend on hiding the algorithm.
Q3. An organization sends confidential transaction messages over an untrusted network. It must
prevent outsiders from reading the messages and detect any unauthorized modification. Which
option best satisfies both requirements?
A) Encode messages using Base64
B) Encrypt messages with a confidentiality-only mode
C) Append an unkeyed hash that travels separately from each message
D) Use authenticated encryption with correctly managed keys and nonces
Rationale: D is correct because authenticated encryption provides confidentiality and an
integrity/authenticity check when implemented correctly. A is merely encoding. B does not
inherently detect tampering. C is inadequate against an active attacker who can modify the
message and calculate a replacement unkeyed hash. The selected algorithm must also be used
according to its requirements, particularly nonce uniqueness where required.
Q4. A developer argues that a cryptographic system is secure because it uses a 256-bit key. The
application nevertheless generates keys from a predictable sequence based on the current time.
What is the principal weakness?
A) A 256-bit key is incompatible with modern encryption
B) Encryption keys must be publicly available
C) Predictable key generation can allow an attacker to guess the key despite its nominal
length
D) Every encryption key must be generated manually
Rationale: C is correct because effective key strength depends on unpredictability, not merely the
number of bits. If the possible keys are generated from a small or predictable set of states, an
attacker may search that set. A is incorrect because 256-bit keys are supported by modern
algorithms. B is incorrect because secret encryption keys must remain protected. D is incorrect
because manual key selection is typically less reliable than secure automated generation.
, 4|Page
Q5. A company needs to prove that a message was produced by someone possessing a shared
secret and was not modified in transit. The company does not need independent public
verification. Which mechanism is most appropriate?
A) Base64 encoding
B) An unkeyed SHA-256 digest
C) A message authentication code, such as HMAC
D) Compression followed by encryption without authentication
Rationale: C is correct because a message authentication code uses a secret key to authenticate
messages and detect unauthorized changes. A does not provide security. B is unkeyed, so an
attacker can modify a message and compute a new digest. D may conceal content but does not
inherently authenticate it. A MAC is suitable when the parties share a secret, although it cannot
independently establish which of several key holders generated a valid tag.
Q6. A supplier signs a contract electronically. The recipient needs to verify the signature using a
public key and determine whether the signed document has changed. Which mechanism best
supports this requirement?
A) AES encryption alone
B) A password hash
C) A shared secret stored in the document
D) A digital signature verified with the signer’s corresponding public key
Rationale: D is correct because a digital signature can provide evidence of the document’s
integrity and that the signature was generated using the corresponding private key. A provides
confidentiality but does not, by itself, establish the signer’s identity. B is intended for one-way
verification rather than document signing. C exposes or embeds a secret without providing a
sound signature-verification process. Reliable attribution also requires appropriate identity
verification and private-key protection.
Q7. A company encrypts files on employee laptops but saves the decryption keys in plaintext in
the same folder. An attacker gains access to that folder. Which corrective action most directly
addresses the problem?
A) Convert the keys to hexadecimal
B) Increase the filenames’ complexity
C) Protect keys separately using restricted access and secure key storage
D) Replace encryption with an unkeyed hash
Rationale: C is correct because encryption depends on keeping keys confidential and limiting
access to authorized users or services. Storing the key beside the ciphertext in plaintext allows
an attacker who obtains both to decrypt the files. A and B merely change representation or
naming. D is not a substitute because hashes are not reversible and cannot replace encryption
when data must later be recovered.
WGU D334 INTRO TO CRYPTOGRAPHY
PA QUESTIONS AND CORRECT
ANSWERS PLUS RATIONALE (ALREADY
GRADED A+) | QUESTION 1–100 |
UPDATED 2026/2027 | DETAILED
RATIONALES | INSTANT DOWNLOAD
INTRODUCTION
WGU D334: Introduction to Cryptography focuses on the cryptographic principles and
techniques used to protect sensitive information, secure digital communications, authenticate
users and systems, and maintain data integrity. This practice question bank is designed for
students preparing for a pre-assessment (PA) who want to strengthen their understanding of core
cryptographic concepts and apply them to practical cybersecurity scenarios.
The subject is important because modern organizations depend on encryption, hashing, digital
signatures, key management, and secure communication protocols to defend against
unauthorized access, tampering, impersonation, and data exposure. Students must understand not
only how cryptographic mechanisms work, but also when to select them, how to implement them
safely, and why seemingly strong systems can fail through poor key handling or protocol
configuration.
This resource provides original multiple-choice practice questions with four options per question
and detailed rationales. The scenarios emphasize analytical reasoning, risk identification,
troubleshooting, and selecting suitable security controls. For the best results, answer each
question before reviewing its explanation, then revisit the concepts you missed. Use the bank
alongside your current course materials to prepare for the assessment and identify areas requiring
additional study. This is an independent study resource, not an official WGU assessment or a
guarantee of a particular grade.
CONTENT AREA OVERVIEW
Suggested
Content area Questions Key topics
study weight
Confidentiality, integrity, authentication,
Cryptographic principles 1–10 10%
nonrepudiation, Kerckhoffs’s principle
AES, block and stream ciphers, modes,
Symmetric cryptography 11–20 10%
IVs, nonces, authenticated encryption
,2|Page
Asymmetric RSA, ECC, public/private keys, key
21–30 10%
cryptography agreement, hybrid encryption
Hashing and password SHA-2, collisions, HMAC, salts,
31–40 10%
security password-hashing functions
Digital signatures and Certificates, certificate authorities, trust
41–50 10%
PKI chains, validation, revocation
Generation, storage, rotation, backup,
Key management 51–60 10%
compromise, destruction
TLS, certificate validation, forward
Secure protocols 61–70 10%
secrecy, downgrade and replay attacks
Authentication, secure storage, message
Applied cryptography 71–80 10%
protection, cryptographic applications
Cryptanalysis and Brute force, side channels, nonce reuse,
81–90 10%
implementation risks weak randomness, padding oracles
Algorithm selection, migration, risk
Security decisions and
91–100 analysis, lifecycle and operational 10%
governance
controls
These percentages are suggested for study planning and are not official WGU assessment
weights.
QUESTIONS 1–100
Cryptographic principles
Q1. A financial application encrypts customer records before storing them in a database. An
attacker steals the database but cannot decrypt the records. However, the attacker changes an
account balance, and the application accepts the modified value. Which security requirement was
not adequately addressed?
A) Confidentiality
B) Integrity
C) Availability
D) Authentication
Rationale: B is correct because integrity protects against unauthorized modification and helps
ensure data has not been altered without detection. Encryption alone may provide confidentiality
without integrity. A is incorrect because the attacker could not decrypt the records, indicating
confidentiality remained effective. C concerns whether systems and information are accessible
when needed. D concerns verifying an identity or source and does not, by itself, ensure stored
records cannot be modified.
Q2. A software company relies on a proprietary encryption algorithm that has never been
independently reviewed. After an attacker obtains a copy of the algorithm, researchers identify a
,3|Page
weakness that makes encrypted data recoverable. Which principle would have discouraged
relying on secrecy of the algorithm itself?
A) Least privilege
B) Separation of duties
C) Kerckhoffs’s principle
D) Data minimization
Rationale: C is correct because Kerckhoffs’s principle holds that a cryptographic system should
remain secure even if its design is public, provided secret keys remain protected. A limits users’
permissions. B divides sensitive tasks among different people or roles. D limits unnecessary
collection or retention of data. None of these replaces the principle that cryptographic security
should not depend on hiding the algorithm.
Q3. An organization sends confidential transaction messages over an untrusted network. It must
prevent outsiders from reading the messages and detect any unauthorized modification. Which
option best satisfies both requirements?
A) Encode messages using Base64
B) Encrypt messages with a confidentiality-only mode
C) Append an unkeyed hash that travels separately from each message
D) Use authenticated encryption with correctly managed keys and nonces
Rationale: D is correct because authenticated encryption provides confidentiality and an
integrity/authenticity check when implemented correctly. A is merely encoding. B does not
inherently detect tampering. C is inadequate against an active attacker who can modify the
message and calculate a replacement unkeyed hash. The selected algorithm must also be used
according to its requirements, particularly nonce uniqueness where required.
Q4. A developer argues that a cryptographic system is secure because it uses a 256-bit key. The
application nevertheless generates keys from a predictable sequence based on the current time.
What is the principal weakness?
A) A 256-bit key is incompatible with modern encryption
B) Encryption keys must be publicly available
C) Predictable key generation can allow an attacker to guess the key despite its nominal
length
D) Every encryption key must be generated manually
Rationale: C is correct because effective key strength depends on unpredictability, not merely the
number of bits. If the possible keys are generated from a small or predictable set of states, an
attacker may search that set. A is incorrect because 256-bit keys are supported by modern
algorithms. B is incorrect because secret encryption keys must remain protected. D is incorrect
because manual key selection is typically less reliable than secure automated generation.
, 4|Page
Q5. A company needs to prove that a message was produced by someone possessing a shared
secret and was not modified in transit. The company does not need independent public
verification. Which mechanism is most appropriate?
A) Base64 encoding
B) An unkeyed SHA-256 digest
C) A message authentication code, such as HMAC
D) Compression followed by encryption without authentication
Rationale: C is correct because a message authentication code uses a secret key to authenticate
messages and detect unauthorized changes. A does not provide security. B is unkeyed, so an
attacker can modify a message and compute a new digest. D may conceal content but does not
inherently authenticate it. A MAC is suitable when the parties share a secret, although it cannot
independently establish which of several key holders generated a valid tag.
Q6. A supplier signs a contract electronically. The recipient needs to verify the signature using a
public key and determine whether the signed document has changed. Which mechanism best
supports this requirement?
A) AES encryption alone
B) A password hash
C) A shared secret stored in the document
D) A digital signature verified with the signer’s corresponding public key
Rationale: D is correct because a digital signature can provide evidence of the document’s
integrity and that the signature was generated using the corresponding private key. A provides
confidentiality but does not, by itself, establish the signer’s identity. B is intended for one-way
verification rather than document signing. C exposes or embeds a secret without providing a
sound signature-verification process. Reliable attribution also requires appropriate identity
verification and private-key protection.
Q7. A company encrypts files on employee laptops but saves the decryption keys in plaintext in
the same folder. An attacker gains access to that folder. Which corrective action most directly
addresses the problem?
A) Convert the keys to hexadecimal
B) Increase the filenames’ complexity
C) Protect keys separately using restricted access and secure key storage
D) Replace encryption with an unkeyed hash
Rationale: C is correct because encryption depends on keeping keys confidential and limiting
access to authorized users or services. Storing the key beside the ciphertext in plaintext allows
an attacker who obtains both to decrypt the files. A and B merely change representation or
naming. D is not a substitute because hashes are not reversible and cannot replace encryption
when data must later be recovered.
