WGU Updated Introduction-to-Cryptography Exam Questions and Answers by raine

A digital signature is a cryptographic mechanism that enables a recipient to verify who created a message (authenticity) and that the message has not been altered (integrity). It is typically built using asymmetric cryptography: the signer uses a private key to sign a hash (digest) of the message, producing a signature. Anyone with the signer’s public key can verify that the signature matches the message digest, confirming the signature was created by the corresponding private key and that the content remains unchanged. Digital signatures do not primarily provide confidentiality; the signed message may still be readable unless separately encrypted. They also support nonrepudiation in many operational contexts because a valid signature can be strong evidence that the private key holder authorized the signed data, assuming key protection and policy controls. Common digital signature algorithms include RSA-PSS, ECDSA, and EdDSA. Certificates (X.509) are often used to bind public keys to identities, allowing verifiers to trust the claimed signer. Therefore, the best definition is a technique to verify authenticity and integrity.

An IV (Initialization Vector) is a value used to ensure that encrypting identical plaintext under the same key produces different ciphertexts, preventing pattern leakage. In many secure designs, the IV must be unique (and often unpredictable) per encryption operation. A common way to ensure uniqueness is to incorporate a nonce—a “number used once.” A nonce can be random, pseudo-random, or a counter-based value depending on the mode and security requirements. For example, CTR mode uses a nonce combined with a counter to produce unique input blocks; GCM uses a nonce/IV to ensure unique authentication and encryption behavior. The encryption key should remain stable across many operations and should not be used as the “randomizer” for IV generation; mixing key material into IV creation in an ad hoc way can create reuse or correlation issues. Plaintext and algorithm do not provide the needed uniqueness property. The nonce concept is specifically about ensuring one-time uniqueness of the starting value so that IV reuse does not repeat keystream blocks (stream modes) or reveal plaintext equality (CBC/CTR). Therefore, the correct choice is Nonce.

A rainbow table attack uses large, precomputed tables that link hash outputs back to likely original inputs (typically passwords). Instead of storing every password→hash pair directly (which would be huge), rainbow tables store chains created by alternating hash operations with reduction functions, allowing attackers to reconstruct candidate plaintexts that produce a given hash. This makes cracking fast , if the target hashes are unsalted and use a known, fast hash function. Salt defeats rainbow tables because the attacker would need separate tables for each salt value, which becomes infeasible when salts are unique and sufficiently large. A dictionary at tack is related but typically computes hashes on the fly from a wordlist rather than using precomputed chain structures. A birthday attack targets collisions, not mapping to original data. Brute-force tries all candidates without precomputation. Because th e question explicitly describes mapping hashed values back to original data via a precomputed approach, the correct choice is Rainbow table.

For protecting credit card data, the primary compliance framework is PCI DSS (Payment Card Industry Data Security Standard). PCI DSS is an industry standard created by major card brands and administered through the PCI Security Standards Council. It sets requirements for organizations that store, process, or transmit cardholder data, including controls around network security, access control, monitoring, and cryptography. PCI DSS explicitly addresses encryption and protection of cardholder data (for example, protecting stored cardholder data and encrypting transmission over open, public networks, and using strong cryptography and secure protocols). CCPA and GDPR are privacy regulations focused on personal data rights and governance, and while they may encourage security measures, they are not specifically the card-industry security standard for payment data. HIPAA applies to protected health information, not payment card data. Therefore, the correct answer is PCI DSS.