ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Industry and regulatory guidance consider RSA 1024-bit keys and SHA-1 hashes too weak for protecting sensitive data. NIST SP 800-131A and PCI DSS define strong cryptography as providing at least 112 bits of effective security, which translates to RSA ≥ 2048 bits and SHA-256 (or stronger) hashing. Selecting algorithms already deprecated increases the risk of feasible brute-force and collision attacks and would put the organization out of compliance. The other statements are inaccurate: PCI DSS allows both symmetric and asymmetric algorithms as long as they are sufficiently strong; HMAC-SHA-1 is itself deprecated for new designs but the core problem here is overall algorithm strength, not the absence of HMAC; RSA and SHA-1 can technically be implemented in a FIPS-validated module, but doing so would still violate current strength requirements.