An organization is implementing a PKI for code signing. They want to ensure that if a developer's signing key is compromised, the impact is limited. Which practice is MOST effective?

Store all private keys in a shared repository for backup.

Revoke the certificate immediately and re-sign all code.

Use a single long-lived certificate for all developers.

Issue short-lived certificates and use a timestamping service.

A development team needs to encrypt sensitive data in a multi-tenant cloud application. They want to ensure that even the cloud provider cannot access the encryption keys. Which approach best meets this requirement?

Use a provider-managed key with encryption at rest.

Use a client-side encryption library and store the keys on-premises.

Use a hardware security module (HSM) in the cloud.

Use a customer-managed key stored in the cloud provider's key management service (KMS).

A company needs to securely exchange a symmetric key with a remote partner. They decide to use asymmetric encryption to encrypt the symmetric key. What is this an example of?

Hybrid encryption, combining the speed of symmetric with the key distribution benefits of asymmetric.

Which practice is a key management best practice for maintaining cryptographic security?

Using the same key for multiple systems to simplify management

Rotating keys on a regular schedule or when compromise is suspected

Storing keys in plaintext in the application source code

Sharing keys over email for convenience

Why should cryptographic keys be stored separately from the encrypted data they protect?

To make the encryption algorithm run faster

To prevent an attacker who gains access to the data from also obtaining the keys

To allow the data to be decrypted by any user

To reduce the storage space required for the encrypted data

GIAC Information Security Fundamentals

Domain 4Objective 1

Foundations of Cryptography and Digital Trust GISF Practice Questions (Page 1)

Part of the Cryptography and Identity domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 1–5

1expert · hard
An organization is implementing a PKI for code signing. They want to ensure that if a developer's signing key is compromised, the impact is limited. Which practice is MOST effective?
Select an answer first
2expert · hard
A development team needs to encrypt sensitive data in a multi-tenant cloud application. They want to ensure that even the cloud provider cannot access the encryption keys. Which approach best meets this requirement?
Select an answer first
3application · medium
A company needs to securely exchange a symmetric key with a remote partner. They decide to use asymmetric encryption to encrypt the symmetric key. What is this an example of?
Select an answer first
4foundation · easy
Which practice is a key management best practice for maintaining cryptographic security?
Select an answer first
5foundation · easy
Why should cryptographic keys be stored separately from the encrypted data they protect?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.