Exam CISSP topic 1 question 384 discussion

Answer C) The CIO doesn't want to change the current symmetric key setup, he is only worried about how to protect the current setup. https://aws.amazon.com/blogs/security/benefits-of-a-key-hierarchy-with-a-master-key-part-two-of-the-aws-cloudhsm-series/

C. Use a hierarchy of encryption keys. Using a hierarchy of encryption keys is a common practice in encryption to enhance security. In this approach, a single master key is used to encrypt and protect other keys, which are used to encrypt the actual data. This provides an additional layer of security and control, as compromising the master key alone doesn't compromise the security of all sensitive data. It allows for better management and rotation of keys as needed.

I go with C. RSA is an asymmetric encryption algorithm that is typically used for key exchange and digital signatures, but it is not ideal for encrypting large amounts of data.

Moderators, RSA is obviously Asymmetric, why is this the answer?

Key hierarchy solves the issue. Its like leveraging hybrid cryptography

C. Use a hierarchy of encryption keys, also known as a key hierarchy, is the BEST approach to achieving the objective by encrypting all sensitive data. This approach involves using different keys for different levels of data, such as using a different key for each individual user or a different key for each specific data set. This allows for more granular control and management of the encryption keys, and reduces the risk of a single key being compromised and all sensitive data being exposed.

One good way is by using a key hierarchy. This is simply a way to organize encryption keys so that a root (or master) key is used to encrypt other keys that are in turn used to encrypt the actual data you want to protect. A key hierarchy provides a powerful pattern for storing an application’s cryptographic keys. It also allows you to use different keys for different data while allowing you to focus your protection efforts on the master key. Ref: https://aws.amazon.com/blogs/security/benefits-of-a-key-hierarchy-with-a-master-key-part-two-of-the-aws-cloudhsm-series/#:~:text=One%20good%20way%20is%20by,storing%20an%20application's%20cryptographic%20keys.

RSA is correct. Rest all are Hash algorithms

File/message will generally be encrypted with a symmetric-key algorithm, and then the symmetric key will be encrypted with RSA encryption. Under this process, only an entity that has access to the RSA private key will be able to decrypt the symmetric key. https://www.comparitech.com/blog/information-security/rsa-encryption/