An organization uses a symmetric key to encrypt backups. The key is stored on the same server as the backups. A security audit recommends separating the key from the data. Which action best addresses this recommendation?

Store the key in a hardware security module (HSM) or a dedicated key management server.

Encrypt the key with a password and store it in the same directory as the backups.

Use a longer key to make it harder to brute-force.

A user receives a certificate error when visiting a website. The certificate is valid, but the browser says it is untrusted. The user's organization uses a proxy that performs SSL inspection. What is the MOST likely cause?

The website's certificate is not signed by a public CA.

The website's certificate has expired.

The user's browser is blocking the proxy's IP address.

The proxy's CA certificate is not installed in the user's browser trust store.

A company's security policy requires that encryption keys be rotated every 90 days. What is the primary reason for this requirement?

To limit the amount of data exposed if a key is compromised.

To comply with the use of symmetric encryption.

A company is setting up a private PKI for internal services. They want to minimize the risk of a compromised root CA. Which practice is most effective?

Publish the root CA's private key in a public repository.

Keep the root CA offline and use an intermediate CA for issuing certificates.

Use a single CA for both root and issuing functions.

Use self-signed certificates for all internal services.

A security analyst is investigating a suspected man-in-the-middle attack on a web session. The user's browser showed a valid HTTPS connection, but the analyst found that the session was intercepted. Which of the following would MOST likely explain this?

The user's browser was using an outdated version of TLS.

The DNS server returned an incorrect IP address for the domain.

The user's device had a rogue CA certificate installed in the trust store.

The web server's private key was weak and easily guessed.

GIAC Information Security Fundamentals

Domain 4Objective 1

Foundations of Cryptography and Digital Trust GISF Practice Questions (Page 4)

Part of the Cryptography and Identity domain, which makes up ~14% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 4–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

7concepts

Questions 16–20

16application · medium
An organization uses a symmetric key to encrypt backups. The key is stored on the same server as the backups. A security audit recommends separating the key from the data. Which action best addresses this recommendation?
Select an answer first
17expert · hard
A user receives a certificate error when visiting a website. The certificate is valid, but the browser says it is untrusted. The user's organization uses a proxy that performs SSL inspection. What is the MOST likely cause?
Select an answer first
18application · medium
A company's security policy requires that encryption keys be rotated every 90 days. What is the primary reason for this requirement?
Select an answer first
19application · medium
A company is setting up a private PKI for internal services. They want to minimize the risk of a compromised root CA. Which practice is most effective?
Select an answer first
20expert · hard
A security analyst is investigating a suspected man-in-the-middle attack on a web session. The user's browser showed a valid HTTPS connection, but the analyst found that the session was intercepted. Which of the following would MOST likely explain this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.