County IT must encrypt multi-terabyte nightly backups for cold storage and separately assert agency identity when calling a partner court API. Which crypto method pairing best fits those two use cases?

Use-case matching drives cryptographic method selection for county operations. Multi-terabyte nightly backups need efficient bulk confidentiality: symmetric encryption protects large volumes when shared keys or envelope-key hierarchies can be managed through a vault or HSM-backed process. Partner court API identity assertion needs proof of agency identity without pre-sharing the same long-lived secret for every payload byte: asymmetric cryptography supports digital signatures, mutual authentication patterns, and key agreement suited to inter-agency trust. Pairing symmetric bulk protection with asymmetric identity services aligns performance with authentication strength.

Asymmetric encryption of entire multi-terabyte backups is typically impractical at scale and misassigns the heavy lifting to public-key algorithms meant for keys, signatures, and small objects—not cold-store streams. Hashing alone provides integrity or fingerprinting, not confidentiality for backups and not a complete identity-assertion protocol for partners. Steganography hides existence rather than providing managed confidentiality controls, and stream ciphers alone do not constitute a partner identity framework.

Exam caveat: CISSP expects designers to choose cryptographic classes by problem type—confidentiality of large data versus authentication and non-repudiation—rather than applying one favorite primitive everywhere.

Operational check: encrypt backup media or pipelines with approved symmetric algorithms and protected key wrapping; issue agency certificates or signed tokens for the court API; monitor key rotation for backup DEKs/KEKs and certificate expiry for partner identity; verify restores still decrypt after rotation drills.