AP Cybersecurity Drill 24: Encrypting Stored Field Files

Question 1. If all three devices are stolen while powered off, which holds its files in a state an ordinary thief cannot simply read?

• A) All three, because each device requires some form of a login or password before anyone can reach the survey files
• B) Field laptop A, because full-disk encryption keeps the stored data unreadable without the key, even off the device ✓
• C) The backup drive, because portable drives connect over a port that most stolen-device thieves are unable to use
• D) Field laptop B, because the login password scrambles the files on disk in the same way encryption would scramble them

Explanation: Choice B is correct. Full-disk encryption keeps data at rest unreadable without the key, so laptop A's files resist a thief even if the disk is removed. Choice A is incorrect because a login password does not encrypt the disk; the drive can be pulled and read directly. Choice C is incorrect because the backup drive is plaintext and easily read on any computer. Choice D is incorrect because a login password controls account access, not on-disk encryption.

Question 2. Laptop A protects its files with one key used to both encrypt and decrypt. This is an example of:

• A) Symmetric encryption, where the same secret key both encrypts and decrypts the data it protects ✓
• B) Asymmetric encryption, where a public key encrypts and a separate private key performs the decryption
• C) Hashing, where a fixed-length digest is produced and the original input cannot be recovered from it
• D) Digital signing, where a private key marks data so a recipient can confirm who actually produced it

Explanation: Choice A is correct. One secret key that performs both encryption and decryption is symmetric encryption, the typical model for full-disk protection. Choice B is incorrect because asymmetric encryption uses a public and private key pair, not one key. Choice C is incorrect because hashing is one-way and is not used to recover stored files. Choice D is incorrect because signing proves origin, not confidentiality of stored data.

Question 3. The team wants to confirm the backup-drive files stay confidential even if the drive is lost. What change achieves that?

• A) Rename the survey files with random names so a finder cannot tell which files contain the confidential survey data
• B) Store the backup drive in a locked drawer, which keeps it safe in the office but not while it travels in a truck
• C) Store each survey file along with a hash digest, which helps check integrity but leaves the readable files exposed on the drive
• D) Encrypt the drive so its contents stay unreadable without the key, protecting the files wherever the drive ends up ✓

Explanation: Choice D is correct. Encrypting the drive keeps the stored files confidential regardless of where the drive travels or who finds it. Choice A is incorrect because renaming hides labels but leaves readable content. Choice B is incorrect because a locked drawer does not protect the drive once it leaves the office. Choice C is incorrect because hashing addresses integrity, not confidentiality, and the readable files would still be present.

Question 4. An analyst opens the backup drive on a spare computer and the survey files display immediately with no key prompt. What does this confirm?

• A) The files are signed, since a valid signature is what allowed the spare computer to open them without any prompt
• B) The files were hashed, since hashing is the only step that lets a different computer display stored files instantly
• C) The files are not protected by effective at-rest encryption, since they display in readable form with no key prompt ✓
• D) The files are encrypted with a strong key, since strong encryption is designed to open quickly on any trusted computer

Explanation: Choice C is correct. Files that display immediately on another computer with no key required are not protected by effective at-rest encryption; the data is readable as stored. Choice A is incorrect because a signature proves origin and does not gate whether files open. Choice B is incorrect because hashing does not let stored files display and is not why they opened. Choice D is incorrect because encrypted data would require the key and would not simply display in readable form.

Question 5. What is the best mitigation across all three storage locations?

• A) Enable encryption at rest on laptop B and on the backup drive so every location matches the protection already on laptop A ✓
• B) Copy every survey file onto laptop A only, then keep using laptop B and the backup drive for non-survey work as before
• C) Replace the login password on laptop B with a longer one, which secures its stored files to the same level as encryption
• D) Switch laptop A from symmetric to hashing so all three devices apply the identical one-way protection to their stored files

Explanation: Choice A is correct. Turning on at-rest encryption for laptop B and the backup drive brings every location up to the protection laptop A already has. Choice B is incorrect because concentrating files on one device does not protect the others and creates a single point of failure. Choice C is incorrect because a longer login password still does not encrypt the disk. Choice D is incorrect because hashing is one-way and cannot protect files that must be opened and used.