A cloud-based SaaS provider needs to encrypt customer data at rest and in transit. They want to use a key management service (KMS) that allows customers to bring their own keys (BYOK). The security team is concerned about the risk of key loss and wants to ensure that keys can be recovered if a customer loses their key. Which approach should they take?

Store customer keys in a database with application-level encryption

Use a single master key for all customers

Use a KMS that supports key escrow and recovery

Use a KMS with no recovery option

What is a key security improvement of WPA3 over WPA2?

It uses TKIP instead of AES for encryption

It eliminates the need for authentication

It provides stronger protection against offline dictionary attacks through Simultaneous Authentication of Equals (SAE)

It uses a fixed 64-bit encryption key

Which component of a TLS cipher suite specifies the algorithm used for key exchange?

The message authentication code (MAC) algorithm

The certificate authority (CA) that issued the server certificate

A security architect is designing a key management strategy for a new application that uses both symmetric and asymmetric encryption. The application needs to encrypt large files at rest and also sign documents. The architect wants to minimize the risk of key compromise. Which strategy is most appropriate?

Use a single AES key for both encryption and signing

Use RSA for file encryption and AES for signing

Use the same RSA key pair for both encryption and signing

Use a symmetric key for file encryption and a separate RSA key pair for signing

A security analyst is investigating a potential man-in-the-middle attack on a web application. The analyst notices that the server certificate is not trusted by the client's browser. Which TLS mechanism should have prevented this?

Certificate validation against a trusted root CA

GIAC Defensible Security Architect

Domain 3Objective 2

Network Encryption and Remote Access GDSA Practice Questions (Page 5)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 21–25

21expert · hard
A cloud-based SaaS provider needs to encrypt customer data at rest and in transit. They want to use a key management service (KMS) that allows customers to bring their own keys (BYOK). The security team is concerned about the risk of key loss and wants to ensure that keys can be recovered if a customer loses their key. Which approach should they take?
Select an answer first
22foundation · easy
What is a key security improvement of WPA3 over WPA2?
Select an answer first
23foundation · easy
Which component of a TLS cipher suite specifies the algorithm used for key exchange?
Select an answer first
24expert · hard
A security architect is designing a key management strategy for a new application that uses both symmetric and asymmetric encryption. The application needs to encrypt large files at rest and also sign documents. The architect wants to minimize the risk of key compromise. Which strategy is most appropriate?
Select an answer first
25application · medium
A security analyst is investigating a potential man-in-the-middle attack on a web application. The analyst notices that the server certificate is not trusted by the client's browser. Which TLS mechanism should have prevented this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Network Encryption and Remote Access GDSA Practice Questions (Page 5)

Questions 21–25

What is a key security improvement of WPA3 over WPA2?

Which component of a TLS cipher suite specifies the algorithm used for key exchange?

A security analyst is investigating a potential man-in-the-middle attack on a web application. The analyst notices that the server certificate is not trusted by the client's browser. Which TLS mechanism should have prevented this?

Keep studying — Network Services and Encryption