Which statement about cryptography for credentials is correct?

Which statement about cryptography for credentials is correct?

• A. They are stored in plaintext.
• B. They are protected with strong cryptography during transmission and storage.
• C. They must be changed weekly.
• D. They are never encrypted.

Answer: (B)

The idea being tested is that credentials must be protected with strong cryptography both when they are moved across networks and when they are stored. In practice, this means using secure protocols to protect data in transit (for example, TLS to prevent eavesdropping and tampering) and applying robust cryptographic protections at rest (such as strong encryption or salted, slow-hash storage for passwords, with proper key management). This dual protection helps prevent credentials from being exposed if data is intercepted or stolen. Storing credentials in plaintext is insecure because there is no protection if the data is accessed. Requiring weekly changes is a policy detail not about cryptography itself and isn’t the reason credentials should be protected. Saying credentials are never encrypted directly contradicts the fundamental security principle of safeguarding sensitive information.

The idea being tested is that credentials must be protected with strong cryptography both when they are moved across networks and when they are stored. In practice, this means using secure protocols to protect data in transit (for example, TLS to prevent eavesdropping and tampering) and applying robust cryptographic protections at rest (such as strong encryption or salted, slow-hash storage for passwords, with proper key management). This dual protection helps prevent credentials from being exposed if data is intercepted or stolen.

Storing credentials in plaintext is insecure because there is no protection if the data is accessed. Requiring weekly changes is a policy detail not about cryptography itself and isn’t the reason credentials should be protected. Saying credentials are never encrypted directly contradicts the fundamental security principle of safeguarding sensitive information.