A company's security policy requires that encryption keys be rotated every 90 days. The company uses a central key management system (KMS) to store keys. Which practice is essential to ensure that key rotation does not disrupt encrypted data?

Use the same key for encryption and decryption without versioning

Keep the old key available for decryption of existing data until it is re-encrypted

Delete the old key immediately after rotation

Store the old key in a backup file on the same server

A network engineer is troubleshooting an IPsec site-to-site VPN that is not passing traffic. The IKE phase 1 completes successfully, but phase 2 fails. The engineer notices that the two sites use different encryption algorithms for the IPsec SA. What is the most likely cause of the phase 2 failure?

The pre-shared keys do not match between the two sites

The remote gateway's public IP address is incorrect

The traffic selectors (proxy IDs) do not match between the two sites

The IKE SA lifetime is too short

A university is upgrading its campus wireless network. The security team wants to support the latest security standards and also allow legacy devices that only support WPA2. Which configuration should they implement?

Enable WPA3-Personal with transition mode

Disable all legacy protocols and require WPA3-Enterprise

Implement open authentication with MAC filtering

Use WPA2-Personal with a shared passphrase

A security engineer is investigating a TLS handshake failure between a client and a server. The client supports TLS 1.2 and TLS 1.3, while the server only supports TLS 1.2. The server's certificate is valid and trusted. The handshake fails during the ServerKeyExchange message. Which is the most likely cause?

The client and server cannot agree on a cipher suite that uses ephemeral Diffie-Hellman

The server's private key is too short

The client does not trust the server's certificate

The server's certificate has expired

When designing a network encryption architecture for remote access, which factor is most important to balance against security?

The brand of the network hardware

The color of the VPN client software

The number of encryption algorithms used

User experience and performance overhead

GIAC Defensible Security Architect

Domain 3Objective 2

Network Encryption and Remote Access GDSA Practice Questions (Page 4)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 16–20

16application · medium
A company's security policy requires that encryption keys be rotated every 90 days. The company uses a central key management system (KMS) to store keys. Which practice is essential to ensure that key rotation does not disrupt encrypted data?
Select an answer first
17application · medium
A network engineer is troubleshooting an IPsec site-to-site VPN that is not passing traffic. The IKE phase 1 completes successfully, but phase 2 fails. The engineer notices that the two sites use different encryption algorithms for the IPsec SA. What is the most likely cause of the phase 2 failure?
Select an answer first
18application · medium
A university is upgrading its campus wireless network. The security team wants to support the latest security standards and also allow legacy devices that only support WPA2. Which configuration should they implement?
Select an answer first
19expert · hard
A security engineer is investigating a TLS handshake failure between a client and a server. The client supports TLS 1.2 and TLS 1.3, while the server only supports TLS 1.2. The server's certificate is valid and trusted. The handshake fails during the ServerKeyExchange message. Which is the most likely cause?
Select an answer first
20foundation · easy
When designing a network encryption architecture for remote access, which factor is most important to balance against security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.