A company is migrating from an IPsec remote-access VPN to an SSL/TLS VPN. The security team is concerned about the SSL/TLS VPN's exposure to web-based attacks. Which security control is most important to implement to protect the SSL/TLS VPN gateway?

Deploy a web application firewall (WAF) in front of the SSL/TLS VPN gateway

Disable all client certificate authentication

Allow all inbound traffic to the VPN gateway

Use PPTP instead of SSL/TLS for the VPN

What is the purpose of the TPM (Trusted Platform Module) in BitLocker's default operation?

To store the encryption keys and verify the integrity of the boot process.

To provide a backup of the recovery key in case the user forgets it.

To allow the user to unlock the drive using a fingerprint.

To encrypt the data on the hard drive using hardware acceleration.

Why is proper key management important in disk encryption?

Keys need to be changed frequently to maintain performance.

If encryption keys are lost or compromised, the encrypted data may become inaccessible or exposed to unauthorized parties.

Keys are stored in the TPM and never need to be backed up.

Key management is only necessary for cloud-based encryption, not local disks.

An organization is deploying BitLocker on laptops without TPM chips. The security team wants to ensure that the encryption keys are protected and that the laptops can be recovered if the user forgets their password. What is the recommended approach for key management in this scenario?

Use a TPM-only protector and rely on the user's password

Store the BitLocker recovery key on the same USB drive as the startup key

Disable BitLocker and use EFS instead

Use a USB startup key and store the recovery key in Active Directory

What is the primary difference between full-disk encryption (FDE) and file-level encryption (FLE)?

FDE encrypts the entire storage device, including system files and metadata, while FLE encrypts individual files or folders.

FDE provides stronger encryption than FLE.

FDE is only available on hardware-based solutions, while FLE is software-based.

FDE is used for data at rest, while FLE is used for data in transit.

EC-CouncilCertified Encryption Specialist

Domain 4Objective 3

VPN Protocols (PPTP, L2TP, IPSec, SSL/TLS) and Disk Encryption ECES Practice Questions (Page 9)

Part of the Applications of Cryptography domain, which makes up ~25% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 41–45

41expert · hard
A company is migrating from an IPsec remote-access VPN to an SSL/TLS VPN. The security team is concerned about the SSL/TLS VPN's exposure to web-based attacks. Which security control is most important to implement to protect the SSL/TLS VPN gateway?
Select an answer first
42foundation · easy
What is the purpose of the TPM (Trusted Platform Module) in BitLocker's default operation?
Select an answer first
43foundation · easy
Why is proper key management important in disk encryption?
Select an answer first
44application · medium
An organization is deploying BitLocker on laptops without TPM chips. The security team wants to ensure that the encryption keys are protected and that the laptops can be recovered if the user forgets their password. What is the recommended approach for key management in this scenario?
Select an answer first
45foundation · easy
What is the primary difference between full-disk encryption (FDE) and file-level encryption (FLE)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECES

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECES” is a trademark of its owner, used for identification only.