nerdexam
CompTIA

SY0-501 · Question #492

A penetration tester has written an application that performs a bit-by-bit XOR 0xFF operation on binaries prior to transmission over untrusted media. Which of the following BEST describes the action…

The correct answer is D. Obfusication. XOR-ing data with a fixed key (0xFF) is a simple bit-flipping technique that conceals the original content without using a proper cryptographic algorithm, making it obfuscation rather than true encryption.

Submitted by minji_kr· Mar 4, 2026General security concepts

Question

A penetration tester has written an application that performs a bit-by-bit XOR 0xFF operation on binaries prior to transmission over untrusted media. Which of the following BEST describes the action performed by this type of application?

Options

  • AHashing
  • BKey exchange
  • CEncryption
  • DObfusication

How the community answered

(24 responses)
  • A
    4% (1)
  • B
    8% (2)
  • C
    4% (1)
  • D
    83% (20)

Why each option

XOR-ing data with a fixed key (0xFF) is a simple bit-flipping technique that conceals the original content without using a proper cryptographic algorithm, making it obfuscation rather than true encryption.

AHashing

Hashing is a one-way deterministic function that produces a fixed-length digest and cannot be reversed to recover the original data, which is fundamentally different from an invertible XOR operation.

BKey exchange

Key exchange refers to a cryptographic protocol (e.g., Diffie-Hellman) used to securely negotiate a shared secret between parties, not a transformation applied to binary data before transmission.

CEncryption

Encryption requires a recognized cryptographic algorithm (e.g., AES, RSA) with proper key management to ensure confidentiality; XOR with a fixed, publicly known constant like 0xFF provides no cryptographic security and does not qualify as encryption.

DObfusicationCorrect

XOR-ing every byte with the static value 0xFF (which simply inverts all bits) provides no cryptographic strength, no key management, and is trivially reversible by any observer who knows the fixed operand. Because it only disguises the data without providing confidentiality guarantees of a recognized cipher, it is classified as obfuscation - a technique that makes data harder to read but does not constitute secure encryption.

Concept tested: Distinguishing obfuscation from true cryptographic techniques

Source: https://csrc.nist.gov/glossary/term/obfuscation

Topics

#obfuscation#XOR cipher#cryptography#data encoding

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice