WGU Introduction to Cryptography (D830) Exam Questions

Answer : B

Symmetric cryptography generally provides the fastest encryption and decryption performance among common cryptographic operations. Algorithms like AES and ChaCha20 are designed for high throughput and efficient implementation in software and hardware (e.g., AES-NI acceleration). Symmetric decryption is computationally similar in cost to symmetric encryption, and both are far faster than asymmetric operations for equivalent security levels. Asymmetric cryptography (RSA, ECC) involves expensive mathematical operations (modular exponentiation or elliptic-curve scalar multiplication), making it much slower and unsuitable for bulk data decryption. That is why real-world secure protocols use asymmetric cryptography primarily to authenticate peers and establish keys, then switch to symmetric encryption for the actual data stream. Hashing is not decryption at all; it is one-way, and there is no ''decrypt'' operation for a hash. Padding is not a decryption mechanism; it is a formatting step used with block ciphers to align plaintext length. Therefore, the correct choice for the operation with the fastest decryption process is symmetric cryptography.

Answer : C

A polyalphabetic substitution cipher uses multiple substitution alphabets rather than a single fixed mapping. The classic cipher that uses a keyword to select shifting alphabets across the message is the Vigenre cipher. In Vigenre, each plaintext letter is shifted by an amount determined by the corresponding key letter (repeating the keyword as needed). For example, a keyword like ''YELLOW'' is aligned under the plaintext; each key character defines a Caesar shift (A=0, B=1, ...) applied to the plaintext character, producing ciphertext. This rotation of alphabets across positions makes Vigenre more resistant to simple frequency analysis than monoalphabetic substitution, because the same plaintext letter may encrypt to different ciphertext letters depending on its position relative to the key. The Pigpen cipher is a symbol substitution cipher, Caesar is monoalphabetic with a single shift, and Playfair is a digraph substitution cipher using a 55 key square, not the repeating-key polyalphabetic method described. Therefore, the correct cipher is Vigenre.

Answer : B

In AES, the number of rounds is explicitly tied to the key length. AES-128 uses 10 rounds, AES-192 uses 12 rounds, and AES-256 uses 14 rounds. The purpose of additional rounds is to increase diffusion and confusion, strengthening resistance against cryptanalysis as the key schedule and state transformations iterate more times. Although key length primarily affects brute-force resistance, AES's designers and standardization parameters link longer keys with more rounds to maintain security margins across variants, especially considering differences in the key schedule structure. Thus, as key length increases from 128 to 192 to 256 bits, the number of rounds increases correspondingly from 10 to 12 to 14. This relationship is fixed by the AES specification and does not vary dynamically at runtime. Therefore, the correct correlation is that the number of rounds increases as the key length increases.

Answer : A

CBC mode introduces chaining between blocks to prevent the pattern leakage inherent in ECB. In CBC, each plaintext block is XORed with the previous ciphertext block before being encrypted with the block cipher. For the first block, CBC uses an Initialization Vector (IV) to serve as the ''previous ciphertext'' input. This makes encryption of each block dependent on the previous block's ciphertext, which is exactly the defining characteristic described in option A. CBC does not generate a continuous stream of key material---that describes stream ciphers or stream-like modes such as CTR/OFB. CBC also does not require a different key per operation; the same symmetric key is reused, while the IV must be fresh/unpredictable to ensure semantic security. The block size is determined by the underlying block cipher (e.g., AES is 128-bit blocks, DES/3DES are 64-bit blocks), not a fixed 32-bit size for CBC itself. Because CBC is not inherently authenticated, best practice is to pair it with a MAC (Encrypt-then-MAC) or use an AEAD mode instead.

Answer : B

AES by itself is a symmetric block cipher that provides confidentiality, but not guaranteed integrity unless used in an authenticated mode. To protect integrity of the plaintext (ensuring it has not been altered), a Message Authentication Code (MAC) can be applied. In the classic Encrypt-then-MAC pattern, the sender encrypts the plaintext with AES and then computes a MAC (often HMAC-SHA-256 or CMAC-AES) over the ciphertext (and relevant headers). The receiver verifies the MAC before attempting decryption, preventing tampering and many padding-oracle style vulnerabilities. Alternatively, AES can be used in an AEAD mode like AES-GCM, which produces an authentication tag serving a similar purpose, but among the listed options the general integrity mechanism is ''MAC.'' RC4 is an unrelated stream cipher and does not provide integrity. RSA is asymmetric and not the standard integrity add-on for AES-encrypted bulk data. Kerberos is an authentication protocol and key distribution system, not a message integrity primitive. Therefore, to protect plaintext integrity when using AES, the correct mechanism is a Message Authentication Code.

Answer : D

Large-scale quantum computers threaten many widely deployed public-key algorithms because quantum algorithms can solve their underlying hard math problems efficiently. In particular, Shor's algorithm can factor large integers and compute discrete logarithms in polynomial time, which directly breaks the security assumptions of RSA (factoring) and traditional Diffie--Hellman/ECC (discrete log). That makes RSA the clearest target among the options. By comparison, symmetric algorithms like AES are affected mainly by Grover's algorithm, which provides a quadratic speedup for brute force; this can be mitigated by using larger keys (e.g., AES-256). Hash functions like SHA-256 also face Grover-style speedups for preimage search, again mitigated by output length/security margin, and collision resistance is impacted differently. ECB is a mode of operation, not a standalone algorithm, and its issues are classical (pattern leakage), not specifically quantum. Therefore, the algorithm most directly threatened by quantum computing among the choices is RSA.

Answer : D

A true random number generator (TRNG) produces outputs derived from nondeterministic physical processes (e.g., thermal noise, oscillator jitter, radioactive decay, or other hardware entropy sources). Because the underlying phenomenon is not algorithmically determined by an input seed in the same way as a PRNG, repeated ''inputs'' (or identical conditions from a software perspective) do not yield the same sequence; the outputs vary unpredictably. By contrast, a pseudorandom number generator (PRNG) is deterministic: given the same seed and internal state, it produces the same output sequence, which is useful for repeatability but means security depends on seed secrecy and proper seeding. ''Prime'' is not a generator type, and ''sequence'' is too generic and does not imply nondeterminism. In cryptographic systems, TRNGs (or hardware entropy sources) are often used to seed cryptographically secure PRNGs (CSPRNGs), combining high-quality entropy with efficient generation. Therefore, the generator that can produce different results for the ''same input data'' is a true random number generator.