Free 212-81 Practice Test Questions and Answers (2026)

Nonce

https://en.wikipedia.org/wiki/Cryptographic_nonce

A nonce is an arbitrary number that can be used just once in a cryptographic communication. It is

similar in spirit to a nonce word, hence the name. It is often a random or pseudo-random number

issued in an authentication protocol to ensure that old communications cannot be reused in replay

attacks.

IPSec has two different modes: transport mode and tunnel mode.

Only the tunnel mode can be used

https://en.wikipedia.org/wiki/IPsec

In tunnel mode, the entire IP packet is encrypted and authenticated. It is then encapsulated into a

new IP packet with a new IP header. Tunnel mode is used to create virtual private networks for

network-to-network communications (e.g. between routers to link sites), host-to-network

communications (e.g. remote user access) and host-to-host communications (e.g. private chat).

Incorrect answers:

Encapsulating Security Payload (ESP) authentication must be used. ESP in transport mode does not

provide integrity and authentication for the entire IP packet. However, in Tunnel Mode, where the

entire original IP packet is encapsulated with a new packet header added, ESP protection is afforded

to the whole inner IP packet (including the inner header) while the outer header (including any outer

IPv4 options or IPv6 extension headers) remains unprotected.

IPSec does not involve gateways. Wrong.

Only transport mode can be used. Transport mode, the default mode for IPSec, provides for end-to-

end security. It can secure communications between a client and a server. When using the transport

mode, only the IP payload is encrypted.

Hash

https://en.wikipedia.org/wiki/Hash_function

A hash function is any function that can be used to map data of arbitrary size to fixed-size values.

VeraCrypt

https://en.wikipedia.org/wiki/VeraCrypt

VeraCrypt is a source-available freeware utility used for on-the-fly encryption (OTFE). It can create a

virtual encrypted disk within a file or encrypt a partition or (in Windows) the entire storage device

with pre-boot authentication.

Incorrect answers:

PGP - designed by Phil Zimmerman as a freeware e-mail security program and was released in 1991.

It was the first widespread public key encryption program.

VPN - A virtual private network (VPN) extends a private network across a public network and enables

users to send and receive data across shared or public networks as if their computing devices were

directly connected to the private network. Applications running across a VPN may therefore benefit

from the functionality, security, and management of the private network. Encryption is a common,

although not an inherent, part of a VPN connection

Cryptool - an open-source project that focuses on the free e-learning software CrypTool illustrating

cryptographic and cryptanalytic concepts. According to "Hakin9", CrypTool is worldwide the most

widespread e-learning software in the field of cryptology.

Finding any method that is more efficient than brute force.

https://en.wikipedia.org/wiki/Cryptanalysis

Bruce Schneier notes that even computationally impractical attacks can be considered breaks:

"Breaking a cipher simply means finding a weakness in the cipher that can be exploited with a

complexity less than brute force. Never mind that brute-force might require 2^128 encryptions; an

attack requiring 2^110 encryptions would be considered a break...simply put, a break can just be a

certificational weakness: evidence that the cipher does not perform as advertised."

IV

https://en.wikipedia.org/wiki/Initialization_vector

In cryptography, an initialization vector (IV) or starting variable (SV) is a fixed-size input to a

cryptographic primitive that is typically required to be random or pseudorandom. Randomization is

crucial for encryption schemes to achieve semantic security, a property whereby repeated usage of

the scheme under the same key does not allow an attacker to infer relationships between segments

of the encrypted message. For block ciphers, the use of an IV is described by the modes of operation.

Randomization is also required for other primitives, such as universal hash functions and message

authentication codes based thereon.

Incorrect answers:

L2TP - PPTP combined with L2F (Layer 2 Forwarding) (Cisco proprietary protocol) - Uses EAP, CHAP,

MS-CHAP, PAP, or S-PAP for authentication. IPSec is used to provide encryption.

Salt - random bits of data intermixed with the message that is to be hashed.

Nonce - an arbitrary number that can be used just once in a cryptographic communication. It is

similar in spirit to a nonce word, hence the name. It is often a random or pseudo-random number

issued in an authentication protocol to ensure that old communications cannot be reused in replay

attacks. They can also be useful as initialization vectors and in cryptographic hash functions.

Correct answers: One-way, Fixed length output

https://en.wikipedia.org/wiki/Cryptographic_hash_function

A cryptographic hash function is a mathematical algorithm that maps data of arbitrary size (often

called the "message") to a bit array of a fixed size (the "hash value", "hash", or "message digest"). It

is a one-way function, that is, a function which is practically infeasible to invert.

Incorrect answers:

Symmetric. Cryptographic algorithms can be categorized into three classes: Hash functions,

Symmetric and Asymmetric algorithms. Differences: purpose and main fields of application.

Requires a key. Well, technically, this is the correct answer. But in the hash-function, “key” is input

data.

Fast. Fast or slow is a subjective characteristic, there are many different algorithms, and here it is

impossible to say this unambiguously like "Symmetric encryption is generally faster than asymmetric

encryption."

X.509 https://en.wikipedia.org/wiki/X.509 In cryptography, X.509 is a standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS, the secure protocol for browsing the web. They are also used in offline applications, like electronic signatures. An X.509 certificate contains a public key and an identity (a hostname, or an organization, or an individual), and is either signed by a certificate authority or self-signed. When a certificate is signed by a trusted certificate authority, or validated by other means, someone holding that certificate can rely on the public key it contains to establish secure communications with another party, or validate documents digitally signed by the corresponding private key. Incorrect answers: RSA - (Rivest–Shamir–Adleman) is a public-key cryptosystem that is widely used for secure data transmission. ElGamal - asymmetric key encryption algorithm for public-key cryptography which is based on the Diffie–Hellman key exchange. It was described by Taher Elgamal in 1985. PAP - used to authenticate users, but is no longer used because the information was sent in cleartext.

CRL

https://ru.wikipedia.org/wiki/Certificate_Revocation_List

Certificate Revocation List (or CRL) is "a list of digital certificates that have been revoked by the

issuing certificate authority (CA) before their scheduled expiration date and should no longer be

trusted".

Incorrect answers:

RA - Used to proxy the certificate requests on behalf of the user and validate whether or not they are

legitimate instead of having the user go directly to the CA. The RA talks to the subordinate CA on

behalf of the user, which makes it harder for the actor to get directly to the certificate authority and

do harm.

RFC – Request for Comments (RFC) is a publication from the Internet Society (ISOC) and its

associated bodies, most prominently the Internet Engineering Task Force (IETF), the principal

technical development and standards-setting bodies for the Internet.

CA - certificate authority or certification authority is an entity that issues digital certificates

WPA2

https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access

WPA (sometimes referred to as the draft IEEE 802.11i standard) became available in 2003. The Wi-Fi

Alliance intended it as an intermediate measure in anticipation of the availability of the more secure

and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE

802.11i (or IEEE 802.11i-2004) standard.

PKI

https://en.wikipedia.org/wiki/Public_key_infrastructure

A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed

to create, manage, distribute, use, store and revoke digital certificates and manage public-key

encryption. The purpose of a PKI is to facilitate the secure electronic transfer of information for a

range of network activities such as e-commerce, internet banking and confidential email. It is

required for activities where simple passwords are an inadequate authentication method and more

rigorous proof is required to confirm the identity of the parties involved in the communication and to

validate the information being transferred.

Incorrect answers:

PIKE - stream cipher was invented by Ross Anderson to be a "leaner and meaner" version of FISH

after he broke FISH in 1994. Its name is supposed to be a humorous allusion to the pike fish.

GOST - hash function, defined in the standards GOST R 34.11-94 and GOST 34.311-95 is a 256-bit

cryptographic hash function. It was initially defined in the Russian national standard GOST R 34.11-94

Information Technology – Cryptographic Information Security – Hash Function. The equivalent

standard used by other member-states of the CIS is GOST 34.311-95.

CA - certificate authority or certification authority (CA) is an entity that issues digital certificates. A

digital certificate certifies the ownership of a public key by the named subject of the certificate. This

allows others (relying parties) to rely upon signatures or on assertions made about the private key

that corresponds to the certified public key. A CA acts as a trusted third party—trusted both by the

subject (owner) of the certificate and by the party relying upon the certificate. The format of these

certificates is specified by the X.509 or EMV standard.

Integral Cryptanalysis

https://en.wikipedia.org/wiki/Integral_cryptanalysis

Integral cryptanalysis is a cryptanalytic attack that is particularly applicable to block ciphers based on

substitution-permutation networks. It was originally designed by Lars Knudsen as a dedicated attack

against Square, so it is commonly known as the Square attack. It was also extended to a few other

ciphers related to Square: CRYPTON, Rijndael, and SHARK. Stefan Lucks generalized the attack to

what he called a saturation attack and used it to attack Twofish, which is not at all similar to Square,

having a radically different Feistel network structure. Forms of integral cryptanalysis have since been

applied to a variety of ciphers, including Hierocrypt, IDEA, Camellia, Skipjack, MISTY1, MISTY2,

SAFER++, KHAZAD, and FOX (now called IDEA NXT).

Incorrect answers:

Chosen Plaintext Attack - is an attack model for cryptanalysis which presumes that the attacker can

obtain the ciphertexts for arbitrary plaintexts. The goal of the attack is to gain information that

reduces the security of the encryption scheme.

Linear Cryptanalysis - is a general form of cryptanalysis based on finding affine approximations to the

action of a cipher. Attacks have been developed for block ciphers and stream ciphers. Linear

cryptanalysis is one of the two most widely used attacks on block ciphers.

Differential Cryptanalysis - is a general form of cryptanalysis applicable primarily to block ciphers, but

also to stream ciphers and cryptographic hash functions. In the broadest sense, it is the study of how

differences in information input can affect the resultant difference at the output. In the case of a

block cipher, it refers to a set of techniques for tracing differences through the network of

transformation, discovering where the cipher exhibits non-random behavior, and exploiting such

properties to recover the secret key (cryptography key).

DESX

https://en.wikipedia.org/wiki/DES-X

In cryptography, DES-X (or DESX) is a variant on the DES (Data Encryption Standard) symmetric-key

block cipher intended to increase the complexity of a brute-force attack using a technique called key

whitening.

Lehmer Random Number Generator https://en.wikipedia.org/wiki/Lehmer_random_number_generator The Lehmer random number generator (named after D. H. Lehmer), sometimes also referred to as the Park–Miller random number generator (after Stephen K. Park and Keith W. Miller), is a type of linear congruential generator (LCG) that operates in multiplicative group of integers modulo n. The general formula is: where the modulus m is a prime number or a power of a prime number, the multiplier a is an element of high multiplicative order modulo m (e.g., a primitive root modulo n), and the seed X0 is coprime to m. Other names are multiplicative linear congruential generator (MLCG) and multiplicative congruential generator (MCG).

IDEA

https://en.wikipedia.org/wiki/International_Data_Encryption_Algorithm

In cryptography, the International Data Encryption Algorithm (IDEA), originally called Improved

Proposed Encryption Standard (IPES), is a symmetric-key block cipher designed by James Massey of

ETH Zurich and Xuejia Lai and was first described in 1991. The algorithm was intended as a

replacement for the Data Encryption Standard (DES). IDEA is a minor revision of an earlier cipher

Proposed Encryption Standard (PES).

The cipher was designed under a research contract with the Hasler Foundation, which became part

of Ascom-Tech AG. The cipher was patented in a number of countries but was freely available for

non-commercial use. The name "IDEA" is also a trademark. The last patents expired in 2012, and

IDEA is now patent-free and thus completely free for all uses.

IDEA was used in Pretty Good Privacy (PGP) v2.0 and was incorporated after the original cipher used

in v1.0, BassOmatic, was found to be insecure. IDEA is an optional algorithm in the OpenPGP

standard.

Incorrect answers:

CAST - symmetric algorithm. Created in 1996 by Carlisle Adams and Stafford Tavares. Operates on 64

bit blocks and has a key size of 40-128 bits. Typically used in GPG and PGP. Encryption is either 12 or

16 rounds.

DES - The Data Encryption Standard is a symmetric-key algorithm for the encryption of digital data.

Although its short key length of 56 bits makes it too insecure for applications, it has been highly

influential in the advancement of cryptography.

RSA - a public-key cryptosystem that is widely used for secure data transmission. It is also one of the

oldest. The acronym RSA comes from the surnames of Ron Rivest, Adi Shamir, and Leonard Adleman,

who publicly described the algorithm in 1977

Blowfish

https://en.wikipedia.org/wiki/Blowfish_(cipher)

Blowfish is a symmetric-key block cipher, designed in 1993 by Bruce Schneier and included in many

cipher suites and encryption products. Blowfish provides a good encryption rate in software and no

effective cryptanalysis of it has been found to date. However, the Advanced Encryption Standard

(AES) now receives more attention, and Schneier recommends Twofish for modern applications.

Blowfish has a 64-bit block size and a variable key length from 32 bits up to 448 bits. It is a 16-round

Feistel cipher and uses large key-dependent S-boxes.

Incorrect answers:

Skipjack - symmetric algorithm. Designed by NSA for the clipper chip - a chip with built in encryption.

The decryption key was kept in key escrow in case law enforcement needed to decrypt data without

the owner's cooperation, making it highly controversial. Uses an 80 bit key to encrypt/decrypt 64 bit

data blocks. It is an unbalanced Feistel network with 32 rounds.

Serpent - symmetric algorithm. Designed by Ross Anderson, Eli Biham, and Lars Knudsen. Has a block

size of 128 bits. Key size is 128, 192, or 256 bits. Uses a substitution-permutation network instead of

Feistel cipher. Uses 32 rounds working with a block of four 32-bit words. Each round applies one of

eight 4-bit to 4-bit S-boxes 32 times in parallel. Designed so all operations can be done in parallel.

MD5 - hash function. Created by Ronald Rivest. Replaced MD4. 128 bit output size, 512 bit block size,

32 bit word size, 64 rounds. Infamously compromised by Flame malware in 2012.

RSA

https://en.wikipedia.org/wiki/RSA_(cryptosystem)

RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem that is widely used for secure data

transmission. It is also one of the oldest. The acronym RSA comes from the surnames of Ron Rivest,

Adi Shamir, and Leonard Adleman, who publicly described the algorithm in 1977. An equivalent

system was developed secretly, in 1973 at GCHQ (the British signals intelligence agency), by the

English mathematician Clifford Cocks. That system was declassified in 1997.

Incorrect answers:

Diffie-Helmann - The first publicly described asymmetric algorithm. A cryptographic protocol that

allows two parties to establish a shared key over an insecure channel. Often used to allow parties to

exchange a symmetric key through some unsecure medium, such as the Internet. It was developed

by Whitfield Diffie and Martin Helmann in 1976.

DES - The Data Encryption Standard is a symmetric-key algorithm for the encryption of digital data.

Although its short key length of 56 bits makes it too insecure for applications, it has been highly

influential in the advancement of cryptography.

Developed in the early 1970s at IBM and based on an earlier design by Horst Feistel, the algorithm

was submitted to the National Bureau of Standards (NBS) following the agency's invitation to

propose a candidate for the protection of sensitive, unclassified electronic government data. In 1976,

after consultation with the National Security Agency (NSA), the NBS selected a slightly modified

version (strengthened against differential cryptanalysis, but weakened against brute-force attacks),

which was published as an official Federal Information Processing Standard (FIPS) for the United

States in 1977.

PKI - A public key infrastructure is a set of roles, policies, hardware, software and procedures needed

to create, manage, distribute, use, store and revoke digital certificates and manage public-key

encryption. The purpose of a PKI is to facilitate the secure electronic transfer of information for a

range of network activities such as e-commerce, internet banking and confidential email. It is

required for activities where simple passwords are an inadequate authentication method and more

rigorous proof is required to confirm the identity of the parties involved in the communication and to

validate the information being transferred.

DH

https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange

Diffie–Hellman key exchange is a method of securely exchanging cryptographic keys over a public

channel and was one of the first public-key protocols as conceived by Ralph Merkle and named after

Whitfield Diffie and Martin Hellman. DH is one of the earliest practical examples of public key

exchange implemented within the field of cryptography. Published in 1976 by Diffie and Hellman,

this is the earliest publicly known work that proposed the idea of a private key and a corresponding

public key.

Incorrect answers:

EC - Elliptic-curve cryptography (ECC) is an approach to public-key cryptography based on the

algebraic structure of elliptic curves over finite fields. ECC allows smaller keys compared to non-EC

cryptography (based on plain Galois fields) to provide equivalent security.

RSA - (Rivest–Shamir–Adleman) is a public-key cryptosystem that is widely used for secure data

transmission. It is also one of the oldest. The acronym RSA comes from the surnames of Ron Rivest,

Adi Shamir, and Leonard Adleman, who publicly described the algorithm in 1977. An equivalent

system was developed secretly, in 1973 at GCHQ (the British signals intelligence agency), by the

English mathematician Clifford Cocks. That system was declassified in 1997.

AES - also known by its original name Rijndael, is a specification for the encryption of electronic data

established by the U.S. National Institute of Standards and Technology (NIST) in 2001. AES is a subset

of the Rijndael block cipher developed by two Belgian cryptographers, Vincent Rijmen and Joan

Daemen, who submitted a proposal[5] to NIST during the AES selection process. Rijndael is a family

of ciphers with different key and block sizes. For AES, NIST selected three members of the Rijndael

family, each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 bits.

y^2 = x^3 + Ax + B

https://en.wikipedia.org/wiki/Elliptic-curve_cryptography

For current cryptographic purposes, an elliptic curve is a plane curve over a finite field (rather than

the real numbers) which consists of the points satisfying the equation:

The key expansion phase

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

KeyExpansion – round keys are derived from the cipher key using the AES key schedule. AES requires

a separate 128-bit round key block for each round plus one more.