A security analyst is reviewing a TLS 1.2 configuration for a web server. The current cipher suite is TLS_RSA_WITH_AES_128_CBC_SHA. The analyst wants to enable forward secrecy to protect past sessions if the server's private key is compromised. Which change should be made?

Switch to a cipher suite that uses ephemeral Diffie-Hellman key exchange, such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Enable TLS session resumption with session IDs

Increase the RSA key size from 2048 to 4096 bits

Change the hash algorithm from SHA-1 to SHA-256

A financial firm uses a hardware security module (HSM) to store the private keys for its TLS certificates. The certificates are used on multiple web servers. The security policy requires that the private keys never leave the HSM. How should the firm configure the web servers to use these keys?

Use the HSM's key generation and signing APIs to perform TLS handshakes

Export the private keys and install them on each web server

Store the keys in the server's local certificate store and back them up to the HSM

Copy the keys to a central file share and reference them from the servers

What is the purpose of the TLS handshake?

To encrypt all application data using a pre-shared key

To negotiate the cipher suite and establish a shared session key

To compress the data before transmission

To authenticate the client to the server using a password

What is the primary purpose of key rotation in an enterprise encryption key management program?

To eliminate the need for secure key storage

To limit the amount of data encrypted with a single key and reduce the impact of a key compromise

To reduce the size of the encryption keys

A large enterprise is migrating to a cloud-based KMS. The security team requires that the cloud provider cannot access the encryption keys. They also need to maintain the ability to encrypt and decrypt data in the cloud with low latency. Which architecture best meets these requirements?

Use a hybrid architecture with an on-premises HSM and a cloud KMS that uses the HSM for cryptographic operations

Use a customer-managed key (CMK) stored in the cloud KMS with the provider's HSM

Encrypt data on-premises and send only ciphertext to the cloud

Store keys in the cloud KMS and allow the provider to manage them

GIAC Defensible Security Architect

Domain 3Objective 2

Network Encryption and Remote Access GDSA Practice Questions (Page 1)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 1–5

1application · medium
A security analyst is reviewing a TLS 1.2 configuration for a web server. The current cipher suite is TLS_RSA_WITH_AES_128_CBC_SHA. The analyst wants to enable forward secrecy to protect past sessions if the server's private key is compromised. Which change should be made?
Select an answer first
2application · medium
A financial firm uses a hardware security module (HSM) to store the private keys for its TLS certificates. The certificates are used on multiple web servers. The security policy requires that the private keys never leave the HSM. How should the firm configure the web servers to use these keys?
Select an answer first
3foundation · easy
What is the purpose of the TLS handshake?
Select an answer first
4foundation · easy
What is the primary purpose of key rotation in an enterprise encryption key management program?
Select an answer first
5expert · hard
A large enterprise is migrating to a cloud-based KMS. The security team requires that the cloud provider cannot access the encryption keys. They also need to maintain the ability to encrypt and decrypt data in the cloud with low latency. Which architecture best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.