An auditor asks whether the city can explain how brute-force, man-in-the-middle, and side-channel attacks threaten its deployed cryptography. What is the best demonstration of that understanding?
Select an answer to reveal the explanation.
Short Explanation
Auditors want you to name the monster and the fence. Brute force hammers keys, MITM sits in the middle of sessions, side channels peek at timing or power—and each needs different defenses. Hand-waving that “AES fixes everything” will not pass.
Full Explanation
CISSP expects awareness of cryptanalytic and related attack methods: brute force against key space, man-in-the-middle against unprotected or poorly authenticated channels, and side-channel attacks that exploit physical or timing leakage rather than mathematical breaks alone. Mapping each class to deployment-specific risks and controls shows operational understanding beyond brand-name algorithm selection.