WGU Updated Introduction-to-Cryptography Exam Questions and Answers by ekam

HIPAA is a U.S. regulation focused on protecting the privacy and security of protected health information (PHI). In relation to encryption, HIPAA’s Security Rule requires covered entities and business associates to implement appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI. Encryption is widely recognized as a key technical safeguard for confidentiality—protecting PHI in transit (e.g., over networks) and at rest (e.g., on storage devices) by making data unreadable without the proper keys. HIPAA does not standardize encryption across all industries, nor does it prohibit electronic health records; it regulates how they must be protected. While HIPAA often uses the term “addressable” for encryption controls (meaning organizations must implement it if reasonable and appropriate, or document an equivalent alternative), the overarching purpose remains protection of patient information through secure measures, with encryption as a central mechanism. Therefore, the best answer is ensuring confidentiality of patient information through secure measures like encryption.

Disk/storage encryption protects data at rest by encrypting the contents of a drive so it remains unreadable without the correct authentication and keys. BitLocker (commonly on Windows) and FileVault (commonly on macOS) are well-known software-based full-disk encryption solutions integrated into their operating systems. They encrypt sectors on disk and typically tie key protection to user credentials and, where available, hardware features such as a TPM or secure enclave to reduce key extraction risk. A VPN encrypts network traffic in transit, not disk storage. An HSM is specialized hardware used to generate, store, and protect cryptographic keys and perform crypto operations; it is not a disk encryption product itself. USB encryption hardware refers to hardware-encrypted removable media, not a software solution for a system disk. Therefore, the correct example of a software encryption solution for disk storage is BitLocker and FileVault.

3DES (Triple DES) commonly uses an Encrypt–Decrypt–Encrypt (EDE) sequence. In the two-key form, it encrypts with key K1, decrypts with key K2, then encrypts again with K1. In the three-key form, it encrypts with K1, decrypts with K2, then encrypts with K3. The EDE construction was chosen partly for backward compatibility: if K1=K2=K3, the scheme reduces to single DES, allowing older systems to interoperate in constrained ways. AES and IDEA do not use an EDE triple-stage process as their defining structure; they are single-pass block ciphers with internal rounds. DES is a single-pass algorithm (one key) rather than a triple application with multiple keys. Therefore, the algorithm described—encrypt with one key, decrypt with another, encrypt with the first—is 3DES. Although now considered legacy, it remains a classic example of increasing effective security by applying a block cipher multiple times with independent keys.

SHA-1 (Secure Hash Algorithm 1) produces a fixed-size output of 160 bits (20 bytes). Hash output size matters in cryptography because it influences collision resistance and the effort required for various attacks. For an ideal n-bit hash, finding a collision by generic means is expected around 2^(n/2) operations (birthday bound). With SHA-1’s 160-bit output, that generic bound would be about 2^80, which was once considered strong; however, SHA-1 has been broken in practice with significantly less work due to cryptanalytic advances, and it is now deprecated for most security uses. Still, the question is strictly about output length, not current suitability. The other options do not match SHA-1: 40 bits would be far too small for a modern hash, 80 bits is not SHA-1’s output, and 320 bits would imply a much larger digest (closer to SHA-256’s 256 bits or SHA-384’s 384 bits). Therefore, the correct SHA-1 output length is 160 bits.