Which architectural approach is commonly used to protect data in transit between a remote user and the corporate network while minimizing the need for per-application configuration?

Using a full-tunnel VPN that encrypts all traffic from the user's device to the corporate gateway

Relying on application-level encryption only

Using a split-tunnel VPN that encrypts only traffic to public websites

Encrypting only the database traffic

A security administrator is configuring a web server to support TLS 1.3. The administrator wants to ensure that the server does not negotiate any cipher suites that do not provide forward secrecy. Which configuration should be applied?

Enable TLS 1.2 with RSA key exchange and disable TLS 1.3

Use a cipher suite that includes static ECDH

Enable only TLS 1.3 and disable all older TLS versions

Enable TLS 1.3 but allow TLS 1.0 as a fallback

A financial services firm is implementing a new encryption key management system. The security team wants to ensure that keys are protected throughout their lifecycle and that the system can scale to thousands of keys. Which approach best meets these requirements?

Store keys in a database with application-level encryption

Use a dedicated hardware security module (HSM) with centralized key management

Use a single master key for all encryption operations

Embed keys in application configuration files

A global law firm needs to provide remote access for attorneys who travel internationally. The firm currently uses an IPsec VPN client that requires installation and configuration. The security team wants to reduce the support burden and ensure that attorneys can connect from any device, including personal tablets. However, the firm also needs to enforce data loss prevention (DLP) policies on all remote sessions. Which solution best balances these requirements?

Use a remote desktop gateway that publishes virtual desktops

Deploy an SSL VPN portal with clientless access and integrate with a cloud access security broker (CASB)

Implement a site-to-site VPN to the firm's headquarters and require attorneys to connect from home offices

Continue using the IPsec VPN client and require installation on personal devices

GIAC Defensible Security Architect

Domain 3Objective 2

Network Encryption and Remote Access GDSA Practice Questions (Page 8)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 36–40

36foundation · easy
Which wireless security protocol introduced the use of AES-CCMP for encryption and is considered the minimum standard for modern Wi-Fi networks?
Select an answer first
37foundation · easy
Which architectural approach is commonly used to protect data in transit between a remote user and the corporate network while minimizing the need for per-application configuration?
Select an answer first
38application · medium
A security administrator is configuring a web server to support TLS 1.3. The administrator wants to ensure that the server does not negotiate any cipher suites that do not provide forward secrecy. Which configuration should be applied?
Select an answer first
39application · medium
A financial services firm is implementing a new encryption key management system. The security team wants to ensure that keys are protected throughout their lifecycle and that the system can scale to thousands of keys. Which approach best meets these requirements?
Select an answer first
40expert · hard
A global law firm needs to provide remote access for attorneys who travel internationally. The firm currently uses an IPsec VPN client that requires installation and configuration. The security team wants to reduce the support burden and ensure that attorneys can connect from any device, including personal tablets. However, the firm also needs to enforce data loss prevention (DLP) policies on all remote sessions. Which solution best balances these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Network Encryption and Remote Access GDSA Practice Questions (Page 8)

Questions 36–40

Which wireless security protocol introduced the use of AES-CCMP for encryption and is considered the minimum standard for modern Wi-Fi networks?

Which architectural approach is commonly used to protect data in transit between a remote user and the corporate network while minimizing the need for per-application configuration?

A security administrator is configuring a web server to support TLS 1.3. The administrator wants to ensure that the server does not negotiate any cipher suites that do not provide forward secrecy. Which configuration should be applied?

A financial services firm is implementing a new encryption key management system. The security team wants to ensure that keys are protected throughout their lifecycle and that the system can scale to thousands of keys. Which approach best meets these requirements?

Keep studying — Network Services and Encryption