Which protocol is commonly used for secure remote command-line access to a server, encrypting the entire session?

HTTP (Hypertext Transfer Protocol)

Which statement correctly compares IPsec transport mode and tunnel mode?

Transport mode is used for site-to-site VPNs, while tunnel mode is used for remote access VPNs.

Transport mode requires a VPN gateway, while tunnel mode does not.

Tunnel mode provides weaker security than transport mode.

Transport mode encrypts only the payload of the IP packet, while tunnel mode encrypts the entire IP packet.

During a TLS handshake, what is the purpose of the 'ClientHello' message?

It initiates the handshake and lists the cipher suites and TLS versions the client supports.

It sends the client's certificate to the server for authentication.

It contains the encrypted session key for the server to decrypt.

It verifies the server's certificate by sending a hash of it.

What is the primary purpose of IPsec in a VPN?

To translate private IP addresses to public IP addresses.

To compress IP packets to reduce bandwidth usage.

To route packets between different networks.

To provide confidentiality, integrity, and authentication for IP packets transmitted over an untrusted network.

A security team needs to inspect outbound HTTPS traffic for data exfiltration. They have implemented a TLS interception proxy that decrypts and re-encrypts traffic. However, some applications are failing because they use certificate pinning. Which approach best addresses this issue while maintaining visibility?

Deploy the proxy's certificate to all endpoints and disable certificate pinning in the applications.

Use a proxy that supports dynamic TLS interception and bypass inspection for pinned applications.

Block all applications that use certificate pinning to ensure full visibility.

Use a network tap to capture traffic and decrypt it offline using the private keys.

GIAC Continuous Monitoring Certification

Domain 7Objective 1

Network Data Encryption GMON Practice Questions (Page 3)

Part of the Data Protection domain, which makes up ~7% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 11–15

11foundation · easy
Which protocol is commonly used for secure remote command-line access to a server, encrypting the entire session?
Select an answer first
12foundation · easy
Which statement correctly compares IPsec transport mode and tunnel mode?
Select an answer first
13foundation · easy
During a TLS handshake, what is the purpose of the 'ClientHello' message?
Select an answer first
14foundation · easy
What is the primary purpose of IPsec in a VPN?
Select an answer first
15expert · hard
A security team needs to inspect outbound HTTPS traffic for data exfiltration. They have implemented a TLS interception proxy that decrypts and re-encrypts traffic. However, some applications are failing because they use certificate pinning. Which approach best addresses this issue while maintaining visibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.