I85PREP
⌘ K
CCIS study materials
CCIS study resources

CCIS: Cryptography and Data Protection

CCIS · Work through your exam, one topic at a time.

All guide sections

Cryptography and Data Protection

Domain 5: Cryptography and Data Protection

This domain tests applied cryptography and data-centric controls: symmetric and asymmetric encryption, hashing, MACs, digital signatures, PKI, TLS, key management, classification, masking, tokenization, and DLP. The exam focuses on selecting the right primitive and protecting keys, not on proving mathematical theorems.

Core rules and concepts

  • Symmetric encryption (for example AES) is fast and used for bulk data. Asymmetric encryption (for example RSA or ECC) solves key distribution and signatures but is slower.
  • Hashes provide integrity, not confidentiality. Use a password-hashing function such as Argon2id, scrypt, or bcrypt with salt; general-purpose hashes are too fast for passwords.
  • A MAC authenticates message integrity with a shared key. A digital signature provides integrity, authentication, and non-repudiation using a private key.
  • TLS protects data in transit and authenticates the server via certificates. It does not protect data at rest or authorize the user.
  • Key management: generate keys in a controlled boundary, restrict access, separate duties, rotate, back up securely, and destroy on schedule. Envelope encryption uses a data key wrapped by a key-encryption key.
  • Data protection follows classification: minimize collection, mask or tokenize where full values are unnecessary, encrypt sensitive stores, and monitor egress with DLP.

Worked example

An application stores customer tax identifiers. You classify them as restricted, encrypt the database with AES-256-GCM, and use envelope encryption with a cloud KMS. The application requests a data key, encrypts the field, and stores only ciphertext and an authenticated tag. Access to the KMS key is limited to the application's workload identity, and key use is logged. Reasoning: AES-GCM provides confidentiality and integrity; envelope encryption limits blast radius; KMS policy and logging protect the root of trust. Storing the key beside the database would defeat the control.

Traps that cost marks

Do not say hashing encrypts data. Do not use a fast hash for passwords. Do not confuse signing with encryption: signing does not hide content. Do not treat TLS as data-at-rest protection. Do not keep keys in source code or unprotected configuration files. Do not tokenize and then store the mapping table without equivalent protection.