Data Protection, Privacy, and Cryptography
Domain 5 - Data Protection, Privacy, and Cryptography
This domain tests data classification, encryption, hashing, key management, and privacy obligations. Expect questions that distinguish confidentiality controls from integrity controls.
Core rules
- Classify data and apply controls by sensitivity, regulatory scope, and business value. Data minimization and retention limits reduce breach impact.
- Encrypt data in transit with TLS and at rest with strong algorithms such as AES-256. Protect keys separately from ciphertext, using a KMS or HSM.
- Hashing is one-way and supports integrity and password storage; encryption is reversible with a key. Base64 is encoding, not encryption.
- Use salted, adaptive password hashes such as Argon2id or bcrypt; never store passwords with reversible encryption.
- Digital signatures provide integrity, authenticity, and non-repudiation when keys are managed correctly.
Worked example
A team plans to store passwords by encrypting them with AES and a shared key. That fails because anyone with the key can decrypt every password. Use a unique salt per password and an adaptive hash. If the database leaks, attackers must crack each hash separately, and the application never needs the original password.
Traps
Calling Base64 encryption; using hashing where reversibility is required; confusing digital signatures with encryption; and forgetting that breach notification duties can apply even when data was encrypted, depending on risk.