Explain the importance of using appropriate cryptographic solutions

This is the largest objective in Domain 1 and it pays interest: crypto reappears throughout Domain 3 (protecting data) and Domain 4 (secure protocols, IAM). Getting it solid here means those come cheaply.

You do not need the mathematics. You need to know which tool does which job, and which pairings are wrong.

Symmetric vs asymmetric

The single most important distinction in the objective.

Real systems use both, and the exam expects you to know why. TLS uses asymmetric crypto to agree on a symmetric session key, then encrypts the actual traffic symmetrically. That combination is called a hybrid approach: asymmetric for the handshake, symmetric for the payload.

Which key does what

This trips people up constantly, because it depends on the goal.

Check yourself

You want to send a file so that only Maria can read it. Which key do you encrypt with?

• Maria's public key
• Maria's private key
• Your private key
• Your public key

Hashing

A hash is a one-way fixed-length fingerprint of data. You cannot reverse it. Identical input always gives identical output; any change gives a completely different output.

Hashing provides integrity, not confidentiality. Hashing is not encryption — there is no key and no way back.

• SHA-256 / SHA-512 — current standard
• MD5, SHA-1 — broken, vulnerable to collisions (two different inputs producing the same hash). Recognise them as wrong answers.

Salting

A salt is random data added to a password before hashing. It means two users with the same password get different hashes, which defeats rainbow tables (precomputed hash lookups).

Key stretching goes further: deliberately slow hashing algorithms (bcrypt, PBKDF2, Argon2) that make brute-forcing expensive. If a question asks how to store passwords securely, the answer involves salting plus a slow algorithm — never plain SHA-256, and never encryption.

Check yourself

Which is the correct way to store user passwords?

• Encrypt them with AES-256
• Hash them with MD5
• Hash them with a salt using bcrypt
• Store them with restricted file permissions

Digital signatures

Combine hashing and asymmetric crypto:

1. Hash the message.
2. Encrypt the hash with your private key. That is the signature.
3. The recipient decrypts it with your public key and compares hashes.

This gives three things at once: integrity (hashes match), authentication (only your private key could produce it) and non-repudiation (you cannot deny it).

It does not give confidentiality. A signed message is still readable by anyone.

PKI

Public Key Infrastructure is the system that makes public keys trustworthy. Without it, a published public key proves nothing about whose it is.

Certificate types worth knowing: wildcard (*.example.com, covers all subdomains), SAN (Subject Alternative Name, covers several named domains), self-signed (no external CA — fine internally, browser warnings externally), and third-party (issued by a trusted public CA).

Encrypting things at different levels

The exam lists these as distinct levels and asks which fits a scenario:

• Full-disk — the whole drive. Protects a lost or stolen laptop. Once booted and unlocked, files are readable by anything running on the machine.
• Partition / volume — a section of storage.
• File — individual files.
• Database / record / column — increasingly granular. Column-level encryption protects one sensitive field (say, card numbers) while leaving the rest queryable.
• Transport — data moving over a network, via TLS.

Key management and hardware

TPM versus HSM is the tested pair: TPM is one chip in one machine; HSM is an appliance serving many.

Obscuring data

Three that are easy to confuse:

Remaining terms

Steganography — hiding data inside other data (a message concealed in an image, audio or video file). It hides the existence of the message, not just its content.

Blockchain — a distributed, append-only ledger where each block contains the hash of the previous one. Altering an old record breaks every subsequent hash, which makes tampering evident. The exam cares about it as an integrity mechanism, not as cryptocurrency.

Key escrow — a trusted third party holds a copy of keys so encrypted data can be recovered if the key is lost. Useful for business continuity, and a risk in itself, since the escrow becomes a target.

Perfect forward secrecy — session keys are generated per session so compromising the long-term private key does not decrypt past recorded traffic.

Cipher suite — the agreed set of algorithms in a TLS connection.

Check yourself

A payment processor replaces stored card numbers with randomly generated values, keeping the real numbers in a separate vault. What is this?

• Masking
• Tokenization
• Hashing
• Steganography