WGU COURSE C836 FUNDAMENTALS OF
INFORMATION SECURITY 596
COMPREHENSIVE TEST 2026 QUESTIONS
WITH ANSWERS GRADED A+
◉ RSA (Rivest-Shamir-Adleman) Encryption. Answer: Most common
internet encryption and authentication system. This asymmetric
system used an algorithm that involves multiplying two large prime
numbers to generate a public key, used to encrypt data and decrypt
an authentication, and a private key, used to decrypt the data and
encrypt an authentication. used all over the world, including in the
Secure Sockets Layer (SSL) protocol, which is used to secure many
common transactions such as Web and e-mail traffic.
◉ Elliptical Curve Cryptography (ECC). Answer: An algorithm that
combines plane geometry with algebra to achieve stronger
authentication with smaller keys compared to traditional methods,
such as RSA, which primarily use algebraic factoring. Smaller keys
are more suitable to mobile devices.
◉ What are some advantages of ECC. Answer: It has a higher
cryptographic strength with shorter keys than many other types of
algorithms, meaning that we can use shorter keys while still
maintaining a very secure form of encryption. It is also a very fast
and efficient type of algorithm, allowing us to implement it on
,hardware with a more constrained set of resources, such as a cell
phone or portable device, more easily. It is implemented in a variety
of cryptographic algorithms, including Secure Hash Algorithm 2
(SHA-2) and Elliptic Curve Digital Signature Algorithm (ECDSA).
◉ What other asymmetric algorithms exist?. Answer: Several other
asymmetric algorithms exist, including ElGamal, Diffie-Hellman, and
Digital Signature Standard (DSS). We can also see a variety of
protocols and applications that are based on asymmetric
cryptography, including Pretty Good Privacy (PGP) for securing
messages and files, SSL and Transport Layer Security (TLS) for
several kinds of traffic including Web and e-mail, and some Voice
over IP (VoIP) for voice conversations. Asymmetric cryptography
has allowed many of the modern methods of secure communication
to exist and will likely continue to be the basis of them for some
time.
◉ What is PGP (Pretty Good Privacy)?. Answer: one of the first
strong encryption tools to reach the eye of the general public and the
media. Created in the early 1990s, the original release of PGP was
based on a symmetric algorithm and could be put to use in securing
data such as communications and files. The original release of PGP
was given away as free software, including the source code. At the
time of its release, PGP was regulated as a munition under the US
International Traffic in Arms Regulations (ITAR) law. Zimmerman
spent several years under investigation for criminal activities, as he
was suspected of exporting PGP out of the country, which was then
,illegal and encryption systems were included under arms trafficking
regulations.
◉ What are hash functions used for?. Answer: Hashes cannot be
used to discover the contents of the original message, or any of its
other characteristics, but can be used to determine whether the
message has changed. In this way, hashes provide integrity, but not
confidentiality.
◉ Give some examples of hash functions:. Answer: MD5 (message-
digest algorithm 5), SHA, SHA-2, SHA-3, MD2, MD4, RACE
◉ Describe data-at-rest and how to protect it. Answer: Any data
stored on media. It's common to encrypt sensitive data-at-rest.
Physical security is at play here as well.
◉ Data in motion. Answer: Data that is moving through a network or
communication platform of some kind. This type of data is best
protected by protecting the data itself (using SSL, TLS) and
protecting the connection (using IPsec VPN, SSL VPN)
◉ Data in Use. Answer: Data that is in the process of being created,
updated, destroyed, or changed. Any data currently being used by a
computer. Because the computer needs to process the data, it is not
encrypted while in use. It is difficult to protect data once an
authorized user has access to it, so permissions, authorization,
, identity and verification must be implemented to ensure the right
people have access to the data.
◉ FISMA (Federal Information Security Management Act). Answer:
The Federal Information Security Modernization Act (FISMA)
provides a framework for ensuring the effectiveness of information
security controls in government. This legislation is intended to
protect government information, operations, and assets from any
natural or manmade threat. FISMA requires each federal agency to
develop, document, and implement an information security program
to protect its information and information systems. Annual reviews
of these programs are required to maintain compliance and keep
security risks to an acceptable level.
a. Federal Information Security Management Act of 2002
b. applies to all US federal government agencies, all state agencies
that administer federal programs (such as Medicare), and all private
companies that support, sell to, or receive grant money from the
federal government.
c. FISMA requires that an organization implement information
security controls that use a risk-based approach - one that handles
security by enumerating and compensating for specific risks.
INFORMATION SECURITY 596
COMPREHENSIVE TEST 2026 QUESTIONS
WITH ANSWERS GRADED A+
◉ RSA (Rivest-Shamir-Adleman) Encryption. Answer: Most common
internet encryption and authentication system. This asymmetric
system used an algorithm that involves multiplying two large prime
numbers to generate a public key, used to encrypt data and decrypt
an authentication, and a private key, used to decrypt the data and
encrypt an authentication. used all over the world, including in the
Secure Sockets Layer (SSL) protocol, which is used to secure many
common transactions such as Web and e-mail traffic.
◉ Elliptical Curve Cryptography (ECC). Answer: An algorithm that
combines plane geometry with algebra to achieve stronger
authentication with smaller keys compared to traditional methods,
such as RSA, which primarily use algebraic factoring. Smaller keys
are more suitable to mobile devices.
◉ What are some advantages of ECC. Answer: It has a higher
cryptographic strength with shorter keys than many other types of
algorithms, meaning that we can use shorter keys while still
maintaining a very secure form of encryption. It is also a very fast
and efficient type of algorithm, allowing us to implement it on
,hardware with a more constrained set of resources, such as a cell
phone or portable device, more easily. It is implemented in a variety
of cryptographic algorithms, including Secure Hash Algorithm 2
(SHA-2) and Elliptic Curve Digital Signature Algorithm (ECDSA).
◉ What other asymmetric algorithms exist?. Answer: Several other
asymmetric algorithms exist, including ElGamal, Diffie-Hellman, and
Digital Signature Standard (DSS). We can also see a variety of
protocols and applications that are based on asymmetric
cryptography, including Pretty Good Privacy (PGP) for securing
messages and files, SSL and Transport Layer Security (TLS) for
several kinds of traffic including Web and e-mail, and some Voice
over IP (VoIP) for voice conversations. Asymmetric cryptography
has allowed many of the modern methods of secure communication
to exist and will likely continue to be the basis of them for some
time.
◉ What is PGP (Pretty Good Privacy)?. Answer: one of the first
strong encryption tools to reach the eye of the general public and the
media. Created in the early 1990s, the original release of PGP was
based on a symmetric algorithm and could be put to use in securing
data such as communications and files. The original release of PGP
was given away as free software, including the source code. At the
time of its release, PGP was regulated as a munition under the US
International Traffic in Arms Regulations (ITAR) law. Zimmerman
spent several years under investigation for criminal activities, as he
was suspected of exporting PGP out of the country, which was then
,illegal and encryption systems were included under arms trafficking
regulations.
◉ What are hash functions used for?. Answer: Hashes cannot be
used to discover the contents of the original message, or any of its
other characteristics, but can be used to determine whether the
message has changed. In this way, hashes provide integrity, but not
confidentiality.
◉ Give some examples of hash functions:. Answer: MD5 (message-
digest algorithm 5), SHA, SHA-2, SHA-3, MD2, MD4, RACE
◉ Describe data-at-rest and how to protect it. Answer: Any data
stored on media. It's common to encrypt sensitive data-at-rest.
Physical security is at play here as well.
◉ Data in motion. Answer: Data that is moving through a network or
communication platform of some kind. This type of data is best
protected by protecting the data itself (using SSL, TLS) and
protecting the connection (using IPsec VPN, SSL VPN)
◉ Data in Use. Answer: Data that is in the process of being created,
updated, destroyed, or changed. Any data currently being used by a
computer. Because the computer needs to process the data, it is not
encrypted while in use. It is difficult to protect data once an
authorized user has access to it, so permissions, authorization,
, identity and verification must be implemented to ensure the right
people have access to the data.
◉ FISMA (Federal Information Security Management Act). Answer:
The Federal Information Security Modernization Act (FISMA)
provides a framework for ensuring the effectiveness of information
security controls in government. This legislation is intended to
protect government information, operations, and assets from any
natural or manmade threat. FISMA requires each federal agency to
develop, document, and implement an information security program
to protect its information and information systems. Annual reviews
of these programs are required to maintain compliance and keep
security risks to an acceptable level.
a. Federal Information Security Management Act of 2002
b. applies to all US federal government agencies, all state agencies
that administer federal programs (such as Medicare), and all private
companies that support, sell to, or receive grant money from the
federal government.
c. FISMA requires that an organization implement information
security controls that use a risk-based approach - one that handles
security by enumerating and compensating for specific risks.
