ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

For encrypting large data sets such as multi-terabyte log archives, a symmetric block cipher like AES is preferred. AES-256 in a mode such as CBC (or an authenticated mode like GCM) provides strong confidentiality with high performance because encryption and decryption operations are computationally efficient and can leverage hardware acceleration (for example, AES-NI). Encrypting the bulk data directly with RSA is impractical; asymmetric algorithms are orders of magnitude slower and are normally limited to encrypting only small amounts of data (typically a data-encryption key, not gigabytes of content). Simply signing the objects offers integrity and non-repudiation but does not encrypt the data, and relying on deprecated ciphers such as RC4 would violate current security best practices. Therefore, using AES-256 with a unique data key for each object is the correct and most efficient choice.