D334 ITAS 2141
Introduction to Cryptography
Latest Final Assessment Review
(With Solutions)
2026
1
,1. Multiple Choice
In AWS KMS, which of the following key types is primarily used to encrypt
data encryption keys for envelope encryption?
A) Asymmetric key
B) Symmetric key
C) Hash key
D) Session key
Answer: B) Symmetric key
Rationale: AWS KMS primarily uses symmetric keys for encrypting data
keys in envelope encryption because symmetric cryptography is fast and
efficient for key wrapping.
2. True/False
AWS CloudHSM uses FIPS 140-2 Level 3 validated hardware security
modules to provide external key storage separate from AWS KMS.
Answer: True
Rationale: CloudHSM provides dedicated HSM appliances meeting FIPS
140-2 Level 3, unlike AWS KMS, which is a managed service.
3. Fill in the Blank
In asymmetric cryptography, the key used to encrypt data is the
__________ key, while the key used to decrypt is the __________ key.
Answer: public, private
Rationale: In public-key cryptography, the public key encrypts, and only
the private key can decrypt.
4. Short Answer
Explain why AWS recommends using envelope encryption for securing
large data objects in S3 rather than direct KMS encryption.
Answer: Because KMS has request rate limits and encrypting large blobs
directly with KMS would be inefficient and costly. Envelope encryption
uses KMS to encrypt a small data key, which is then used to encrypt large
2
, data objects locally or in S3.
Rationale: Envelope encryption balances performance and security.
5. Matching
Match the following AWS services with their primary cryptographic
functions:
a) AWS KMS
b) AWS CloudHSM
c) AWS Secrets Manager
d) AWS Certificate Manager
SSL/TLS certificate management
Hardware-based key storage
Key management and cryptographic operations
Secure storage and rotation of passwords and secrets
Answer: a-3, b-2, c-4, d-1
Rationale: Each service has a distinct cryptographic role in AWS security.
6. Multiple Choice
Which cryptographic hash function is considered more secure and is
recommended for digital signatures in AWS environments?
A) MD5
B) SHA-1
C) SHA-256
D) LM hash
Answer: C) SHA-256
Rationale: SHA-256 is part of the SHA-2 family and is currently considered
secure, while MD5 and SHA-1 are vulnerable.
7. True/False
Digital signatures provide both data integrity and non-repudiation but
not confidentiality.
Answer: True
3
Introduction to Cryptography
Latest Final Assessment Review
(With Solutions)
2026
1
,1. Multiple Choice
In AWS KMS, which of the following key types is primarily used to encrypt
data encryption keys for envelope encryption?
A) Asymmetric key
B) Symmetric key
C) Hash key
D) Session key
Answer: B) Symmetric key
Rationale: AWS KMS primarily uses symmetric keys for encrypting data
keys in envelope encryption because symmetric cryptography is fast and
efficient for key wrapping.
2. True/False
AWS CloudHSM uses FIPS 140-2 Level 3 validated hardware security
modules to provide external key storage separate from AWS KMS.
Answer: True
Rationale: CloudHSM provides dedicated HSM appliances meeting FIPS
140-2 Level 3, unlike AWS KMS, which is a managed service.
3. Fill in the Blank
In asymmetric cryptography, the key used to encrypt data is the
__________ key, while the key used to decrypt is the __________ key.
Answer: public, private
Rationale: In public-key cryptography, the public key encrypts, and only
the private key can decrypt.
4. Short Answer
Explain why AWS recommends using envelope encryption for securing
large data objects in S3 rather than direct KMS encryption.
Answer: Because KMS has request rate limits and encrypting large blobs
directly with KMS would be inefficient and costly. Envelope encryption
uses KMS to encrypt a small data key, which is then used to encrypt large
2
, data objects locally or in S3.
Rationale: Envelope encryption balances performance and security.
5. Matching
Match the following AWS services with their primary cryptographic
functions:
a) AWS KMS
b) AWS CloudHSM
c) AWS Secrets Manager
d) AWS Certificate Manager
SSL/TLS certificate management
Hardware-based key storage
Key management and cryptographic operations
Secure storage and rotation of passwords and secrets
Answer: a-3, b-2, c-4, d-1
Rationale: Each service has a distinct cryptographic role in AWS security.
6. Multiple Choice
Which cryptographic hash function is considered more secure and is
recommended for digital signatures in AWS environments?
A) MD5
B) SHA-1
C) SHA-256
D) LM hash
Answer: C) SHA-256
Rationale: SHA-256 is part of the SHA-2 family and is currently considered
secure, while MD5 and SHA-1 are vulnerable.
7. True/False
Digital signatures provide both data integrity and non-repudiation but
not confidentiality.
Answer: True
3
