ITPEC FE Subject B October 2025 Question 19
From the answer group below, select the correct combination of answers to be inserted into A and B in the description.
Company R is a software company that sells video editing software for consumers. The company has branch offices in multiple countries, all managed by its head office. In Company R’s customer support department, customer satisfaction surveys are sent to selected customer who have received support. The survey results are aggregated at each branch, and must be sent to the customer survey analysis team at the head office every day. Ms. T at the customer survey analysis team at the head office is responsible for managing and securing the survey data. The considerations for collecting survey data from each branch office are as follows:
- •The employees responsible for sending the survey data at each branch office changes daily.
- •At the head office, Ms. T in the customer survey analysis team is responsible for receiving and analyzing the survey data from the branch offices. After receiving the survey data from the branch offices, she saves the data to a shared folder that only the customer survey analysis team can access.
- •The file size of survey data is large, so using inefficient encryption methods would take too much time and is therefore not suitable.
- •Since the survey data contains confidential information, it must be ensured that no one other than the sender and the intended recipients can view the contents during transmission between the head office and branch offices.
- •The key used to encrypt the files must be transmitted in a way that prevents it from being stolen by a man-in-the-middle attacker.
- •There are many branch offices and it is not practical to visit each office in person to distribute keys.
Ms. T decided to adopt a new method in which the branch offices upload the survey data, encrypted using file encryption, to a shared folder. She set up this shared folder with access permissions granted to both the head office and branch office staff, and instructed the branch office staff to upload the encrypted survey data to it. Taking into account the considerations related to collecting information from the branches, Ms. T decided to use A as the encryption method. In this method, the key used for encrypting the survey data is encrypted using the public key of B .
Answer group
Explanation
A: hybrid encryption, B: Ms. T — encrypt the large file with a fast symmetric key, and protect that key with the public key of the person who will decrypt it.
The considerations rule out each single method. The files are large, so the data itself must be encrypted with a symmetric key; public key encryption of the whole file is too slow. The symmetric key must then reach the receiver safe from a man-in-the-middle and without visiting each branch, which a public key solves: anyone may hold it, and only the owner of the matching private key can decrypt. Hybrid encryption combines the two: a symmetric key encrypts the survey data, and a public key encrypts that symmetric key.
The key is encrypted for whoever must decrypt it. Branch staff send and Ms. T receives and analyses the data, so the branch encrypts the symmetric key with Ms. T's public key and only her private key can recover it. The branch staff, who change daily, need no key pair of their own.
Answer (a)
Why not others:
- •(c) and (d) — public key encryption alone is too slow for large survey files, against the efficiency requirement
- •(e) and (f) — with symmetric encryption alone the key itself must be delivered to every branch, with no protection from a man-in-the-middle and no in-person distribution possible
- •(b) — a key encrypted with the branch staff's public key can be decrypted only with the branch staff's private key, so Ms. T could not open the files
Key rule: In hybrid encryption the bulk data uses a symmetric key and only that short key is encrypted with a public key, always the recipient's, never the sender's.
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.