1|Page
WGU D334 PA INTRO TO
CRYPTOGRAPHY [QUESTION 1-100]
AND ANSWERS UPDATED 2026/2027 |
DETAILED RATIONALES | ORIGINAL
PRACTICE QUESTIONS | INSTANT
STUDY GUIDE
INTRODUCTION
The WGU D334 Introduction to Cryptography Pre-Assessment is a useful preparation resource
for students studying foundational cryptographic concepts, secure communications,
authentication, digital signatures, key management, and common cryptographic vulnerabilities.
This study guide is designed for learners who want to strengthen their understanding of
cryptography and apply it to realistic cybersecurity scenarios.
The practice questions emphasize application-level reasoning rather than simple memorization.
Scenarios cover selecting appropriate encryption methods, protecting stored passwords,
validating digital certificates, preserving data integrity, managing cryptographic keys, and
identifying weaknesses in security implementations. Each question includes four answer choices,
one best answer, and a detailed rationale explaining why the correct choice fits the scenario and
why the alternatives do not.
Use this guide alongside your course materials and the current official competency requirements.
Work through each question before reviewing its explanation, record the topics you miss, and
revisit those concepts until you can explain the underlying security principles in your own words.
These are original practice questions, not actual or guaranteed questions from WGU's
assessment. No practice bank can guarantee a particular score, but deliberate practice and careful
review can help you prepare more confidently.
CONTENT AREA OVERVIEW
Content area Questions Key topics Study emphasis
Confidentiality, integrity,
Cryptographic
1–10 authentication, nonrepudiation, threat Core concepts
foundations
models
Symmetric and AES, RSA, ECC, hybrid encryption,
11–20 Algorithm selection
asymmetric encryption key exchange
,2|Page
Hashing and password Hash functions, salting, password
21–30 Secure storage
security hashing, collision resistance
Integrity and digital MAC, HMAC, signatures, verification,
31–40 Message assurance
signatures trust
Certificate chains, X.509, CA trust, Certificate
PKI and certificates 41–50
revocation validation
Secure protocols and TLS, HTTPS, forward secrecy, MITM, Secure
51–60
key exchange replay protection communications
Modes, nonces, and GCM, CBC, CTR, IVs, nonces, Safe
61–70
randomness random-number generation implementation
Key management and Storage, rotation, access control, Operational
71–80
lifecycle backup, destruction security
Brute force, birthday attacks, padding
Cryptographic attacks 81–90 Threat recognition
oracles, downgrade attacks
Applied cryptographic Architecture choices, troubleshooting, Scenario-based
91–100
design layered security decisions
The question allocation above is a study-guide distribution, not an official WGU domain-
weighting table.
QUESTIONS 1–100
Cryptographic Foundations
Q1: A healthcare organization encrypts patient records using AES. An attacker obtains a copy of
the encrypted database but does not possess the encryption key. Which security objective is most
directly provided by this control?
A) Nonrepudiation of every database transaction
B) Confidentiality of the patient records
C) Proof that the database has not been modified
D) Authentication of every employee accessing the database
Rationale: B is correct because encryption protects confidentiality by making readable
information inaccessible without the required key. A is incorrect because encryption alone does
not establish nonrepudiation or prove who performed a transaction. C is incorrect because
ordinary encryption does not necessarily detect unauthorized modifications; an authenticated
encryption scheme or separate integrity mechanism is needed. D is incorrect because encryption
does not independently authenticate employees.
,3|Page
Q2: A software vendor distributes an update signed with its private signing key. A customer
verifies the signature using the vendor's trusted public key. What does successful verification
primarily establish?
A) The update contains no software vulnerabilities
B) The update is confidential to the customer
C) The signed content has not changed since signing and verifies under the corresponding
public key
D) The update was encrypted using AES
Rationale: C is correct because a valid digital signature provides evidence that the signed data
has not been altered and that the signature corresponds to the public key. A is incorrect because
a signature does not establish that software is safe or vulnerability-free. B is incorrect because
signatures do not encrypt content. D is incorrect because digital signatures and AES encryption
serve different purposes.
Q3: A company needs to ensure that a message has not been modified in transit and that the
receiver can verify it came from a holder of a shared secret. Both systems already possess the
same secret key. Which mechanism is most appropriate?
A) An unsalted SHA-256 digest sent beside the message
B) Base64 encoding of the message
C) AES encryption without authentication
D) HMAC using a secure hash function and the shared secret
Rationale: D is correct because HMAC uses a secret key and a hash-based construction to
authenticate a message and detect unauthorized modification. A is incorrect because an attacker
can alter the message and recompute an unkeyed hash. B is incorrect because Base64 is
encoding, not cryptographic protection. C is incorrect because encryption without authentication
may not reliably detect tampering.
Q4: An organization encrypts a file using a strong algorithm but stores the encryption key in
plaintext beside the file. An attacker compromises the storage system and obtains both items.
What is the principal failure?
A) The algorithm has insufficient key length
B) The key-management design defeats the intended confidentiality protection
C) The plaintext file was not hashed before encryption
D) The encryption algorithm has necessarily been cryptographically broken
Rationale: B is correct because possession of both the ciphertext and its unprotected key can
allow the attacker to decrypt the file without breaking the algorithm. A is incorrect because the
scenario does not establish that the key length is weak. C is incorrect because hashing the file
would not protect a plaintext key. D is incorrect because exploiting poor key storage is not the
same as breaking the encryption algorithm.
, 4|Page
Q5: A financial institution requires evidence that a particular authorized signer approved a
transaction. It also needs to detect changes to the signed transaction details. Which control is
most suitable?
A) A shared account password recorded in a log
B) Symmetric encryption performed with a key known to all employees
C) A digital signature created with the signer's private key and verified using a trusted
public key
D) A checksum calculated without a secret or signature key
Rationale: C is correct because a digital signature can link the signed content to a private
signing key and detect changes to that content. A is incorrect because a shared password in a log
provides weak attribution and may be reused or disclosed. B is incorrect because every holder of
a shared key may be able to produce the same type of cryptographic evidence, weakening
individual attribution. D is incorrect because an ordinary checksum is not an authentication or
nonrepudiation mechanism.
Q6: A system encrypts a message but provides no authentication tag or signature. An attacker
changes bits in the ciphertext before delivery. Which conclusion is most accurate?
A) The receiver is guaranteed to reject the altered ciphertext
B) The attacker must know the encryption key to alter any ciphertext bit
C) Encryption automatically proves the sender's identity
D) The receiver may be unable to detect tampering unless the system includes an
appropriate integrity mechanism
Rationale: D is correct because confidentiality alone does not guarantee integrity. Depending on
the algorithm and mode, ciphertext modifications may be undetected or may predictably affect
decrypted data. A is incorrect because rejection is not guaranteed without authentication or
suitable validation. B is incorrect because some ciphertext modifications can be made without
knowing the key. C is incorrect because encryption alone does not authenticate a sender.
Q7: A developer argues that a proprietary encryption algorithm is secure because its internal
design has never been published. Which security principle most strongly challenges this
reasoning?
A) Cryptographic systems should avoid all public standards
B) Security depends primarily on keeping the algorithm secret
C) A sound cryptographic design should remain secure when the algorithm is known and
the keys remain secret
D) Publicly reviewed algorithms cannot use secret keys
Rationale: C is correct because modern cryptography generally assumes the adversary knows
the algorithm; security should rely on sound design and proper key secrecy. A is incorrect
because public standards enable interoperability and review. B is incorrect because relying on
WGU D334 PA INTRO TO
CRYPTOGRAPHY [QUESTION 1-100]
AND ANSWERS UPDATED 2026/2027 |
DETAILED RATIONALES | ORIGINAL
PRACTICE QUESTIONS | INSTANT
STUDY GUIDE
INTRODUCTION
The WGU D334 Introduction to Cryptography Pre-Assessment is a useful preparation resource
for students studying foundational cryptographic concepts, secure communications,
authentication, digital signatures, key management, and common cryptographic vulnerabilities.
This study guide is designed for learners who want to strengthen their understanding of
cryptography and apply it to realistic cybersecurity scenarios.
The practice questions emphasize application-level reasoning rather than simple memorization.
Scenarios cover selecting appropriate encryption methods, protecting stored passwords,
validating digital certificates, preserving data integrity, managing cryptographic keys, and
identifying weaknesses in security implementations. Each question includes four answer choices,
one best answer, and a detailed rationale explaining why the correct choice fits the scenario and
why the alternatives do not.
Use this guide alongside your course materials and the current official competency requirements.
Work through each question before reviewing its explanation, record the topics you miss, and
revisit those concepts until you can explain the underlying security principles in your own words.
These are original practice questions, not actual or guaranteed questions from WGU's
assessment. No practice bank can guarantee a particular score, but deliberate practice and careful
review can help you prepare more confidently.
CONTENT AREA OVERVIEW
Content area Questions Key topics Study emphasis
Confidentiality, integrity,
Cryptographic
1–10 authentication, nonrepudiation, threat Core concepts
foundations
models
Symmetric and AES, RSA, ECC, hybrid encryption,
11–20 Algorithm selection
asymmetric encryption key exchange
,2|Page
Hashing and password Hash functions, salting, password
21–30 Secure storage
security hashing, collision resistance
Integrity and digital MAC, HMAC, signatures, verification,
31–40 Message assurance
signatures trust
Certificate chains, X.509, CA trust, Certificate
PKI and certificates 41–50
revocation validation
Secure protocols and TLS, HTTPS, forward secrecy, MITM, Secure
51–60
key exchange replay protection communications
Modes, nonces, and GCM, CBC, CTR, IVs, nonces, Safe
61–70
randomness random-number generation implementation
Key management and Storage, rotation, access control, Operational
71–80
lifecycle backup, destruction security
Brute force, birthday attacks, padding
Cryptographic attacks 81–90 Threat recognition
oracles, downgrade attacks
Applied cryptographic Architecture choices, troubleshooting, Scenario-based
91–100
design layered security decisions
The question allocation above is a study-guide distribution, not an official WGU domain-
weighting table.
QUESTIONS 1–100
Cryptographic Foundations
Q1: A healthcare organization encrypts patient records using AES. An attacker obtains a copy of
the encrypted database but does not possess the encryption key. Which security objective is most
directly provided by this control?
A) Nonrepudiation of every database transaction
B) Confidentiality of the patient records
C) Proof that the database has not been modified
D) Authentication of every employee accessing the database
Rationale: B is correct because encryption protects confidentiality by making readable
information inaccessible without the required key. A is incorrect because encryption alone does
not establish nonrepudiation or prove who performed a transaction. C is incorrect because
ordinary encryption does not necessarily detect unauthorized modifications; an authenticated
encryption scheme or separate integrity mechanism is needed. D is incorrect because encryption
does not independently authenticate employees.
,3|Page
Q2: A software vendor distributes an update signed with its private signing key. A customer
verifies the signature using the vendor's trusted public key. What does successful verification
primarily establish?
A) The update contains no software vulnerabilities
B) The update is confidential to the customer
C) The signed content has not changed since signing and verifies under the corresponding
public key
D) The update was encrypted using AES
Rationale: C is correct because a valid digital signature provides evidence that the signed data
has not been altered and that the signature corresponds to the public key. A is incorrect because
a signature does not establish that software is safe or vulnerability-free. B is incorrect because
signatures do not encrypt content. D is incorrect because digital signatures and AES encryption
serve different purposes.
Q3: A company needs to ensure that a message has not been modified in transit and that the
receiver can verify it came from a holder of a shared secret. Both systems already possess the
same secret key. Which mechanism is most appropriate?
A) An unsalted SHA-256 digest sent beside the message
B) Base64 encoding of the message
C) AES encryption without authentication
D) HMAC using a secure hash function and the shared secret
Rationale: D is correct because HMAC uses a secret key and a hash-based construction to
authenticate a message and detect unauthorized modification. A is incorrect because an attacker
can alter the message and recompute an unkeyed hash. B is incorrect because Base64 is
encoding, not cryptographic protection. C is incorrect because encryption without authentication
may not reliably detect tampering.
Q4: An organization encrypts a file using a strong algorithm but stores the encryption key in
plaintext beside the file. An attacker compromises the storage system and obtains both items.
What is the principal failure?
A) The algorithm has insufficient key length
B) The key-management design defeats the intended confidentiality protection
C) The plaintext file was not hashed before encryption
D) The encryption algorithm has necessarily been cryptographically broken
Rationale: B is correct because possession of both the ciphertext and its unprotected key can
allow the attacker to decrypt the file without breaking the algorithm. A is incorrect because the
scenario does not establish that the key length is weak. C is incorrect because hashing the file
would not protect a plaintext key. D is incorrect because exploiting poor key storage is not the
same as breaking the encryption algorithm.
, 4|Page
Q5: A financial institution requires evidence that a particular authorized signer approved a
transaction. It also needs to detect changes to the signed transaction details. Which control is
most suitable?
A) A shared account password recorded in a log
B) Symmetric encryption performed with a key known to all employees
C) A digital signature created with the signer's private key and verified using a trusted
public key
D) A checksum calculated without a secret or signature key
Rationale: C is correct because a digital signature can link the signed content to a private
signing key and detect changes to that content. A is incorrect because a shared password in a log
provides weak attribution and may be reused or disclosed. B is incorrect because every holder of
a shared key may be able to produce the same type of cryptographic evidence, weakening
individual attribution. D is incorrect because an ordinary checksum is not an authentication or
nonrepudiation mechanism.
Q6: A system encrypts a message but provides no authentication tag or signature. An attacker
changes bits in the ciphertext before delivery. Which conclusion is most accurate?
A) The receiver is guaranteed to reject the altered ciphertext
B) The attacker must know the encryption key to alter any ciphertext bit
C) Encryption automatically proves the sender's identity
D) The receiver may be unable to detect tampering unless the system includes an
appropriate integrity mechanism
Rationale: D is correct because confidentiality alone does not guarantee integrity. Depending on
the algorithm and mode, ciphertext modifications may be undetected or may predictably affect
decrypted data. A is incorrect because rejection is not guaranteed without authentication or
suitable validation. B is incorrect because some ciphertext modifications can be made without
knowing the key. C is incorrect because encryption alone does not authenticate a sender.
Q7: A developer argues that a proprietary encryption algorithm is secure because its internal
design has never been published. Which security principle most strongly challenges this
reasoning?
A) Cryptographic systems should avoid all public standards
B) Security depends primarily on keeping the algorithm secret
C) A sound cryptographic design should remain secure when the algorithm is known and
the keys remain secret
D) Publicly reviewed algorithms cannot use secret keys
Rationale: C is correct because modern cryptography generally assumes the adversary knows
the algorithm; security should rely on sound design and proper key secrecy. A is incorrect
because public standards enable interoperability and review. B is incorrect because relying on
