[Link] of the following types of encryption technology can be divided into?

(multiple choice)
A. Symmetric encryption
B. Symmetric encryption
C. Fingerprint encryption
D. Data encryption

n the context of standard information technology and cryptography, the correct answer is
primarily based on how encryption keys are managed.

The most accurate options from a technical standpoint are:

●​ A. Symmetric encryption
●​ B. Asymmetric encryption (Note: Your option B says "Symmetric" again, but in a
standard multiple-choice test, this is almost certainly a typo for Asymmetric
encryption).

[Link] of the following options are correct about the AH and ESP security protocols? (multiple
choice)
A. AH can provide encryption and verification functions
B. ESP can provide encryption and verification functions
C. The agreement number of AH is 51.
D. The ESP agreement number is 51.

In the context of IPsec (Internet Protocol Security), the correct options are B and C.

Analysis of the Options:

●​ A. AH can provide encryption and verification functions (Incorrect): The

Authentication Header (AH) protocol provides data integrity (verification) and origin
authentication, but it does not support encryption. It is used to ensure that a packet
has not been tampered with, but the data remains visible in plain text.
●​ B. ESP can provide encryption and verification functions (Correct): The
Encapsulating Security Payload (ESP) protocol is more versatile. It can provide
confidentiality (encryption), data integrity (verification), origin authentication, and
anti-replay services.
●​ C. The agreement (protocol) number of AH is 51 (Correct): In the IP header's
protocol field, the value 51 is reserved specifically for the Authentication Header (AH).
●​ D. The ESP agreement (protocol) number is 51 (Incorrect): The protocol number for
ESP is actually 50.

3.- The "Caesar Password" is mainly used to encrypt data by using a stick of a specific
specification.
A. True
B. False
The correct answer is B. False.

Why this is False

The description provided—using a "stick of a specific specification"—actually refers to the

Scytale (pronounced skit-uh-lee), not the Caesar Password (Caesar Cipher).

●​ Scytale (The "Stick" Method): Used by the ancient Greeks (specifically the Spartans),
this involved wrapping a strip of leather or parchment around a wooden rod of a specific
diameter. The message was written along the length of the rod. When the strip was
unwound, the letters appeared scrambled. To read it, the recipient needed a stick of the
exact same thickness.
●​ Caesar Cipher: This is a substitution cipher where each letter in the plaintext is
"shifted" a certain number of places down the alphabet. For example, with a shift of 3, 'A'
becomes 'D', and 'B' becomes 'E'. It does not require a physical stick; it only requires
knowing the "shift" number.

4. Which of the following is the encryption technology used in digital envelopes?

A. Symmetric encryption algorithm
B. Asymmetric encryption algorithm
C. Hash algorithm
D. Stream encryption algorithm

In the context of standard network security and cryptography exams, a "digital envelope" is a
hybrid encryption method.

The correct answers are A and B.

How a Digital Envelope Works

A digital envelope combines the speed of symmetric encryption with the secure key distribution
of asymmetric encryption.

1.​ Symmetric Encryption (Option A): The actual data (the "letter") is encrypted using a
fast symmetric algorithm (like AES). This creates a session key (or data encryption
key).
2.​ Asymmetric Encryption (Option B): Because you need to get that session key to the
recipient securely, you encrypt the session key itself using the recipient's public key.

[Link] of the following options are part of the way a PKI entity applies for a local certificate
from a CA? (multiple choice)
A. Apply online
B. Local application
C. Network application
D. Apply offline

In the context of Public Key Infrastructure (PKI) and Network Security (such as Huawei or Cisco
certification exams), the process of applying for a certificate from a Certificate Authority (CA) is
generally categorized into two main ways: online and offline.

The correct options are A and D.

Explanation of Application Methods:

●​ A. Apply online (Correct): This is the most common method. The entity (such as a
router or server) generates a Certificate Signing Request (CSR) and sends it to the CA
over a network protocol in real-time. Protocols like CMPv2 (Certificate Management
Protocol), SCEP (Simple Certificate Enrollment Protocol), or EST (Enrollment over
Secure Transport) are used for this.
●​ D. Apply offline (Correct): In high-security environments, the entity may not have a
direct network path to the CA. In this case, the CSR is generated locally, exported to a
physical file (like a .req or .p10 file), and transported to the CA via a secure manual
method (such as a USB drive or email). The CA then signs it and the administrator
manually imports the resulting certificate back to the entity

[Link] of the following is not a symmetric encryption algorithm?

A. DES
B. 3DES
C. AES
D. RSA

he correct answer is D. RSA.

Explanation of the Options:

Encryption algorithms are classified into two main types: Symmetric (one key for both locking
and unlocking) and Asymmetric (a pair of public and private keys).

●​ A. DES (Data Encryption Standard): A classic symmetric block cipher. It uses a 56-bit
key. Though now considered weak against modern computers, it was the standard for
decades.​
+1
●​ B. 3DES (Triple DES): A symmetric algorithm that applies the DES cipher three times
to each data block to increase security.​
+1
●​ C. AES (Advanced Encryption Standard): The current global symmetric standard. It
is highly efficient and secure, using key lengths of 128, 192, or 256 bits.
 ●​ D. RSA (Rivest-Shamir-Adleman): This is an Asymmetric encryption algorithm. It uses
a public key for encryption and a private key for decryption. It is primarily used for
secure key exchange and digital signatures rather than encrypting large amounts of
data.

[Link] certificates can be classified into local certificates, CA certificates, root certificates, and
self-signed certificates
according to different usage scenarios.
A. True
B. False

The answer is A. True.

In the context of Public Key Infrastructure (PKI) and network security (especially within
professional certification paths like Huawei HCIA/HCIP or Cisco), digital certificates are indeed
categorized based on their role and how they are issued within the trust hierarchy.

Breakdown of the Certificate Types:

●​ Root Certificate: The "top" of the trust chain. It is a self-signed certificate belonging to a
Root CA. Operating systems and browsers come pre-installed with trusted Root
Certificates.
●​ CA Certificate: Certificates belonging to Certificate Authorities (both Root and
Intermediate). These are used to sign and issue certificates to other entities.
●​ Local Certificate (End-Entity Certificate): This is the certificate issued to a specific
entity, such as a web server, a router, or an individual user. It is called "local" because it
is the certificate used by the local device to identify itself.
●​ Self-Signed Certificate: A certificate where the issuer and the subject are the same.
While Root Certificates are technically self-signed, the term "self-signed certificate" is
often used to describe certificates generated by administrators for internal testing or
private use without a formal CA

[Link] of the following descriptions is wrong about the root CA certificate?

A. The issuer is CA
B. The certificate subject name is CA
C. Public key information is the public key of the CA
D. Signature is generated by CA public key encryption

The correct answer is D. Signature is generated by CA public key encryption.

Detailed Analysis of the Options

In a Public Key Infrastructure (PKI), the Root CA certificate is the anchor of trust. Because it is
at the very top of the hierarchy, it has unique properties that distinguish it from subordinate or
local certificates.
 ●​ A. The issuer is CA (Correct): In a root certificate, the Certificate Authority (CA) is the
entity that issues the certificate.
●​ B. The certificate subject name is CA (Correct): Since a root certificate is
self-signed, the "Subject" (who the certificate belongs to) and the "Issuer" (who signed
the certificate) are the same.
●​ C. Public key information is the public key of the CA (Correct): The certificate
contains the public key that corresponds to the CA's private key. This public key is used
by clients to verify any certificates signed by this CA.
●​ D. Signature is generated by CA public key encryption (WRONG): This is the
incorrect statement. Digital signatures are generated by using the CA's private key to
encrypt a hash of the certificate data. The public key is used by others to verify the
signature, not to generate it.

9. A and B communication communicates with each other. If an asymmetric encryption algorithm

is used for encryption,
when A sends data to B, which of the following keys will be used for data encryption?
A. A public key
B. A private key
C. B's public key
D. B's private key

The correct answer is C. B's public key.

In asymmetric encryption (Public Key Cryptography), the fundamental rule for confidentiality is
that you encrypt data with the recipient's public key.

Why B's Public Key?

Asymmetric encryption uses a mathematically linked pair of keys: a Public Key (which
everyone can see) and a Private Key (which only the owner knows).

●​ Encryption (The Lock): When A wants to send a private message to B, A uses B's
Public Key. Think of this like a "one-way lock." Anyone can use B's public lock to close
a box, but once it is closed, the public key cannot open it again.
●​ Decryption (The Key): Only B's Private Key has the mathematical "shape" required to
undo the encryption performed by B's public key. Since B is the only person who has this
private key, only B can read the data.

9. Which of the following is not part of a digital certificate?

A. Public key
B. Private key
C. Validity period
D. Issuer

The correct answer is B. Private key.

A digital certificate is essentially a "digital identity card" that is public-facing. Its primary purpose
is to verify the ownership of a public key and bind it to a specific entity (like a website, person,
or device).

+1

Analysis of the Components

●​ A. Public key (Included): This is a core part of the certificate. It is the key that others
use to encrypt data for you or verify your digital signatures.
●​ B. Private key (NOT Included): This key is the "secret half" of the pair. It must never be
included in the certificate itself. If a private key were part of the certificate, everyone who
downloaded your certificate could impersonate you or decrypt your private data. The
owner generates the private key and keeps it securely stored (e.g., in a Hardware
Security Module or a secure file).​
+2
●​ C. Validity period (Included): Every certificate contains a "Not Before" and "Not After"
date. Once the expiration date passes, browsers and systems will no longer trust the
certificate.​
+1
●​ D. Issuer (Included): This identifies the Certificate Authority (CA) that verified the
information and signed the certificate, such as DigiCert or Let's Encrypt

[Link] of the following is not an asymmetric encryption algorithm?

A. DH
B. MD5
C. DSA
D. RSA

The correct answer is B. MD5.

Explanation of the Options:

●​ A. DH (Diffie-Hellman): This is an asymmetric key exchange algorithm. It allows two

parties to establish a shared secret over an insecure channel using a public/private key
pair. While it doesn't "encrypt" data in the traditional sense like RSA, it is fundamentally a
part of the asymmetric (public-key) family.
●​ B. MD5 (Message-Digest Algorithm 5): This is not an encryption algorithm at all; it is
a cryptographic hash function. Hash functions are one-way processes that generate a
fixed-size "fingerprint" of data for integrity checks. Unlike symmetric or asymmetric
encryption, hashing is not reversible (you cannot "decrypt" a hash to get the original data
back).
●​ C. DSA (Digital Signature Algorithm): This is an asymmetric algorithm used
specifically for creating and verifying digital signatures. Like RSA, it uses a public and
private key pair.
 ●​ D. RSA (Rivest-Shamir-Adleman): This is the most famous asymmetric encryption
algorithm. It is used for both data encryption and digital signatures

[Link] evidence preservation is directly related to the legal effect of evidence, in line with
the preservation of legal
procedures, and its authenticity and reliability are guaranteed. Which of the following is not an
evidence preservation
technology?
A. Encryption technology
B. Digital certificate technology
C. Digital signature technology
D. Message tag tracking technology
A. Encryption technology: Used to protect the confidentiality of the evidence during storage
and transmission. By encrypting the evidence, forensic investigators ensure that unauthorized
parties cannot view or modify the data, which is a critical part of maintaining the security of the
evidence "container."
B. Digital certificate technology: Used to provide identity authentication. It ensures that the
person or system accessing or managing the evidence is who they claim to be. This is essential
for establishing a secure and trusted "Chain of Custody."
C. Digital signature technology: This is a fundamental preservation tool. It combines hashing
(for integrity) and asymmetric encryption (for non-repudiation). It allows a court to verify that
the evidence has not changed by even a single bit since it was signed and confirms the identity
of the person who collected it.
D. Message tag tracking technology (The Wrong Option): While "tagging" is used in general
IT for data classification (like marking an email as "Spam" or "Work") or in logistics for tracking
physical assets (RFID), it is not a specialized technology for preserving the legal effect of
digital evidence. Tracking a message tag helps with organization or routing, but it does not
mathematically guarantee the authenticity or reliability of the evidence itself.
[Link] certificate technology solves the problem that public key owners cannot determine in
digital signature technology
A. True
B. False

he answer is A. True.

In pure digital signature technology, there is a fundamental "identity problem": even if the math
proves that a message was signed by a specific public key, it does not prove who actually
owns that key.

The Problem Solved

Without a digital certificate, an attacker (Eve) could generate her own public/private key pair and
claim, "This is Alice's public key." If Bob believes her, he might accept a forged message signed
by Eve, thinking it came from Alice.
Digital certificate technology solves this by using a trusted third party (the Certificate
Authority or CA):

1.​ Identity Binding: The CA verifies the physical identity of the owner (Alice).
2.​ Certification: The CA creates a digital certificate that "binds" Alice's identity to her
specific public key.
3.​ Trust: When Bob receives Alice’s signature, he checks her digital certificate. Since he
trusts the CA, he can now be certain that the public key he is using to verify the
signature truly belongs to Alice.

[Link] of the following information is encrypted during the use of digital envelopes? (multiple
choice)
A. Symmetric key
B. User data
C. Receiver public key
D. Receiver private key

In a digital envelope, two main components are encrypted to balance security and performance.
The correct answers are A and B.

What is Encrypted?

●​ A. Symmetric key (Correct): The symmetric key (also called a session key or data
encryption key) is encrypted using the recipient's public key. This ensures that only the
holder of the corresponding private key can unlock the symmetric key.
●​ B. User data (Correct): The actual content or payload (the "letter" inside the envelope)
is encrypted using a symmetric algorithm (like AES). Symmetric encryption is used
here because it is significantly faster than asymmetric encryption for large amounts of
data.​
+1

Why the other options are incorrect:

●​ C. Receiver public key: The public key is intended to be public. It is used to perform the
encryption of the symmetric key, but the public key itself is not encrypted.
●​ D. Receiver private key: The private key must be kept secret by the recipient at all
times. It is used to decrypt the digital envelope once it arrives, but it is never transmitted
or encrypted as part of the digital envelope process

14. In the digital signature process, which of the following is the HASH algorithm to verify the
integrity of the data
transmission?
A. User data
B. Symmetric key
C. Receiver public key
D. Receiver private key

In the digital signature process, the User data (the actual message or document) is the part that
is processed by the HASH algorithm to verify integrity.

The correct answer is A. User data.

How Hashing Works in Digital Signatures

The primary goal of a digital signature is to prove that the data has not been changed (Integrity)
and that it came from the correct sender (Authenticity). The process follows these steps:

1.​ Hashing: The sender takes the User data (Option A) and runs it through a hash function
(like SHA-256). This creates a unique, fixed-length "fingerprint" called a message
digest.
2.​ Signing: The sender encrypts that message digest using their own private key. This
encrypted hash is the "Digital Signature."
3.​ Verification: The receiver receives the data and the signature. They perform two
actions:
○​ They use the sender's public key to decrypt the signature and reveal the original
hash.
○​ They run the received User data through the same HASH algorithm to create a
new hash.
4.​ Comparison: If the two hashes match, it proves the user data was not modified during
transmission

[Link] of the following options are characteristic of a symmetric encryption algorithm?

(multiple choice)
A. Fast encryption
B. Confidential speed is slow
C. Key distribution is not secure
D. Key distribution security is high

The correct answers are A and C.

Analysis of the Options:

●​ A. Fast encryption (Correct): Symmetric algorithms (like AES) use simpler

mathematical operations than asymmetric ones. They are extremely efficient and can
encrypt/decrypt large volumes of data (bulk encryption) very quickly with low CPU
overhead.
●​ B. Confidential speed is slow (Incorrect): This is the opposite of the truth. Symmetric
encryption is known for its high speed. Asymmetric encryption (like RSA) is the one that
is relatively slow.
 ●​ C. Key distribution is not secure (Correct): This is the "Achilles' heel" of symmetric
encryption. Because both parties must use the exact same key, they must find a way to
share that key without an attacker intercepting it. If the key is stolen during distribution,
the entire system is compromised.
●​ D. Key distribution security is high (Incorrect): As mentioned above, securing the key
exchange is the primary challenge and weakness of symmetric systems. High key
distribution security is a characteristic of Asymmetric encryption, where the encryption
key (public key) can be shared openly.

[Link] are the following options for encryption technology to protect data during data
transmission? (multiple choice)
A. Confidentiality
B. Controllability
C. Integrity
D. Source verification

The correct answers are A, C, and D.

Breakdown of the Options

●​ A. Confidentiality (Correct): This is the most well-known purpose of encryption. It

ensures that only the intended recipient with the correct decryption key can read the
message. If an attacker intercepts the data in transit, they only see unreadable
ciphertext.
●​ B. Controllability (Incorrect): While controllability is a general security goal (referring to
the ability to manage and monitor access), it is not a direct technical output of an
encryption algorithm itself. It is usually handled by access control lists (ACLs) or
management frameworks.
●​ C. Integrity (Correct): Modern encryption protocols (like those used in HTTPS/TLS) use
"Message Authentication Codes" (MACs) or hashing to ensure that data has not been
tampered with or altered during transmission.
●​ D. Source verification (Correct): Also known as Authentication or Origin
Verification. Digital signatures (a key part of encryption technology) allow the receiver to
verify that the data truly came from the claimed sender and not an impersonator.

17. Which of the following options is not part of the hashing algorithm?
A. MD5
B. SHA1
C. SM1
D. SHA2

The correct answer is C. SM1.

Explanation of the Options:

To solve this, we need to distinguish between hashing algorithms (one-way functions for
integrity) and encryption algorithms (two-way functions for confidentiality).

●​ A. MD5 (Message Digest 5): A classic hashing algorithm. While no longer secure for
high-stakes security due to collision vulnerabilities, it is still used for basic file integrity
checks.
●​ B. SHA1 (Secure Hash Algorithm 1): A hashing algorithm developed by the NSA. Like
MD5, it is now considered legacy and has been deprecated in favor of stronger
alternatives.
●​ C. SM1: This is not a hashing algorithm. It is a symmetric block encryption
algorithm (part of the Chinese National Secret standards). It is comparable to AES and
is typically implemented in hardware (chips) rather than software. The hashing
equivalent in the Chinese National Secret series is SM3.
●​ D. SHA2: A family of hashing algorithms (including SHA-256 and SHA-512) that is
currently the industry standard for secure data integrity and digital signatures.

[Link] of the following is not the certificate save file format supported by the USG6000
series?
A. PKCS#12
B. DER
C. PEM
D. PKCS#

The correct answer is D. PKCS#.

Detailed Analysis

In Huawei network security devices like the USG6000 series, certificate management is strictly
defined by international cryptographic standards. The system supports specific file formats for
importing, exporting, and storing certificates.

●​ A. PKCS#12 (Supported): This is a binary format (often with .p12 or .pfx extensions)
used to store the server certificate, intermediate certificates, and the private key in a
single password-protected file.
●​ B. DER (Supported): Standing for Distinguished Encoding Rules, this is a binary
representation of a certificate. It is commonly used on Java-based platforms and by
Huawei devices for raw certificate data.
●​ C. PEM (Supported): Standing for Privacy Enhanced Mail, this is the most common
format. It is a Base64 encoded ASCII file that starts with -----BEGIN
CERTIFICATE-----. It is highly portable and human-readable.​
+2
●​ D. PKCS# (Not Supported/Invalid): This is not a specific file format. "PKCS" stands for
Public-Key Cryptography Standards, which is a family of standards (like PKCS#1,
PKCS#7, PKCS#12). A file format must specify the version number (e.g., PKCS#7 or
 PKCS#12) to be valid. In multiple-choice questions for Huawei certifications, "PKCS#" is
often used as a distractor because it is an incomplete term

[Link] of the following is used to encrypt digital fingerprints in digital signature technology?
A. sender public key
B. sender private key
C. Receiver public key
D. Receiver private key

The correct answer is B. sender private key.

In digital signature technology, a "digital fingerprint" (technically known as a message digest or

hash) is encrypted specifically to provide authenticity and non-repudiation.

Why the Sender's Private Key?

Digital signatures turn the traditional encryption process "on its head." While we usually encrypt
data with a public key so only one person can read it, we sign data with a private key so
everyone can verify it.

●​ The Process: 1. The sender runs the original data through a hash algorithm to create a
unique digital fingerprint (the hash). 2. The sender encrypts this fingerprint using their
private key. This encrypted hash is the Digital Signature.​
+2
●​ The Purpose: Since the private key is known only to the sender, if the receiver can
successfully decrypt the fingerprint using the sender’s public key, it proves that the
signature could only have been created by that specific sender.

[Link] signature technology obtains a digital signature by encrypting which of the following
data?
A. User data
B. Receiver public key
C. sender public key
D. Digital fingerprint
The correct answer is D. Digital fingerprint.

In the digital signature process, we do not encrypt the entire document (User data) because
asymmetric encryption is computationally slow and inefficient for large files. Instead, we encrypt
a condensed version of that data.

How the Signature is Obtained:

1.​ Hashing: The original User data is passed through a hash algorithm (like SHA-256).
2.​ Generating the Fingerprint: The result is a unique, fixed-length string of characters
called a Digital fingerprint (also known as a Message Digest
3.​ Encryption: This digital fingerprint is then encrypted using the sender's private key.
 4.​ Result: The resulting encrypted fingerprint is the Digital Signature.

Why the other options are not the "data" being encrypted:
●​ A. User data: While user data is the source of the signature, it is not the data directly
encrypted to create the signature. We hash it first to create a smaller "fingerprint" for
speed and efficiency.
●​ B. Receiver public key: This key is used for confidentiality (to ensure only the receiver
can read a message), but it plays no role in creating the sender's digital signature.
●​ C. Sender public key: The public key is used by the receiver to decrypt and verify the
signature. You cannot create a signature using a public key; it must be done with the
secret private key.

Component Role in the Process

User Data The original message/document.

Digital Fingerprint The data that is encrypted to become the signature.

Sender's Private Key The "tool" used to perform the encryption.

Digital Signature The final output attached to the document.