A network administrator is setting up a new web server and wants to ensure that client connections are encrypted and the server is authenticated. The administrator has obtained a certificate from a public CA. What must the administrator configure on the server to enable TLS?

Configure the server to use a self-signed certificate instead

Enable TLS but disable certificate validation on the server

Install only the certificate on the server

Install the certificate and private key on the server and enable TLS with a strong cipher suite

A security administrator is responsible for managing TLS private keys for multiple web servers. The administrator wants to ensure that keys are protected from unauthorized access and that a compromise of one server does not expose keys for other servers. Which practice should be implemented?

Store all private keys in a shared file on a network share

Embed the private key in the application source code

Use the same private key for all servers to simplify management

Store each server's private key in a hardware security module (HSM) with access controls

What is the primary purpose of key rotation in encryption key management?

To make the encryption algorithm faster.

To allow multiple users to share the same key.

To limit the amount of data encrypted with a single key, reducing the impact of a key compromise.

To eliminate the need for secure key storage.

A security team is implementing TLS interception to monitor encrypted traffic. They are concerned about the performance impact on the network. Which approach minimizes the performance impact while still providing visibility?

Use a software-based proxy on the same server as the applications to reduce network latency.

Disable TLS interception during peak hours to avoid performance degradation.

Use a dedicated TLS interception appliance with hardware acceleration for cryptographic operations.

Intercept all traffic, including traffic to high-volume streaming services, to ensure complete visibility.

A company is deploying IPsec VPNs for remote access. They need to support both Windows and Linux clients. The security team wants to ensure that the VPN provides confidentiality and integrity, and that it can authenticate users with certificates. Which IPsec configuration should they use?

IKEv1 with pre-shared keys and 3DES

L2TP/IPsec with PSK and AES-CBC

GIAC Continuous Monitoring Certification

Domain 7Objective 1

Network Data Encryption GMON Practice Questions (Page 2)

Part of the Data Protection domain, which makes up ~7% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 6–10

6application · easy
A network administrator is setting up a new web server and wants to ensure that client connections are encrypted and the server is authenticated. The administrator has obtained a certificate from a public CA. What must the administrator configure on the server to enable TLS?
Select an answer first
7application · medium
A security administrator is responsible for managing TLS private keys for multiple web servers. The administrator wants to ensure that keys are protected from unauthorized access and that a compromise of one server does not expose keys for other servers. Which practice should be implemented?
Select an answer first
8foundation · easy
What is the primary purpose of key rotation in encryption key management?
Select an answer first
9expert · hard
A security team is implementing TLS interception to monitor encrypted traffic. They are concerned about the performance impact on the network. Which approach minimizes the performance impact while still providing visibility?
Select an answer first
10expert · hard
A company is deploying IPsec VPNs for remote access. They need to support both Windows and Linux clients. The security team wants to ensure that the VPN provides confidentiality and integrity, and that it can authenticate users with certificates. Which IPsec configuration should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.