A healthcare organization is subject to HIPAA and must encrypt all electronic protected health information (ePHI) in transit. They currently use TLS for external communications but some internal legacy systems communicate over plaintext HTTP. What is the most appropriate action to achieve compliance?

Implement TLS on all internal and external communications that transmit ePHI

Use a VPN only for remote access, leaving internal traffic unencrypted

Disable encryption for legacy systems to avoid performance issues

Encrypt only external communications because internal networks are trusted

A security engineer is configuring TLS for a high-traffic e-commerce site. The site must support a wide range of clients, including older browsers, but the security team wants to avoid known weak ciphers. Which cipher suite configuration best balances compatibility and security?

Enable TLS 1.2 and 1.3 with ECDHE key exchange and AES-GCM ciphers

Enable TLS 1.0 and 1.1 with RC4 to support legacy clients

Use only RSA key exchange with CBC ciphers for maximum compatibility

Enable only TLS 1.3 with AES-GCM and ChaCha20-Poly1305

A developer is implementing a client-server application that must authenticate the server to the client and then encrypt the session. The developer wants to avoid the overhead of asymmetric encryption for the bulk data. Which approach should the developer use?

Use a hash function to authenticate the server and then use symmetric encryption

Use asymmetric encryption for the entire session

Use symmetric encryption for both authentication and data

Use asymmetric encryption to exchange a symmetric session key, then use symmetric encryption for the data

A multinational company operates an IPsec VPN between two data centers. The security team must rotate the pre-shared keys (PSKs) used for IKE authentication. The rotation must not cause a significant outage, and the team wants to maintain the same tunnel endpoints. Which approach should they take?

Change the PSK on only one peer and leave the other unchanged

Rebuild the entire VPN tunnel from scratch with a new PSK

Delete the old PSK first, then configure the new PSK on both peers

Configure a new PSK on both peers and then delete the old PSK after the new one is active

A network administrator needs to connect two remote branch offices over the internet. The traffic between them includes legacy protocols that cannot be modified to use TLS. The administrator wants to encrypt all traffic between the two sites without changing the applications. Which solution should be implemented?

Application-layer TLS termination on each server

IPsec transport mode between the branch routers

SSH port forwarding for each legacy protocol

Site-to-site IPsec VPN in tunnel mode

GIAC Continuous Monitoring Certification

Domain 7Objective 1

Network Data Encryption GMON Practice Questions (Page 4)

Part of the Data Protection domain, which makes up ~7% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 16–20

16application · medium
A healthcare organization is subject to HIPAA and must encrypt all electronic protected health information (ePHI) in transit. They currently use TLS for external communications but some internal legacy systems communicate over plaintext HTTP. What is the most appropriate action to achieve compliance?
Select an answer first
17application · medium
A security engineer is configuring TLS for a high-traffic e-commerce site. The site must support a wide range of clients, including older browsers, but the security team wants to avoid known weak ciphers. Which cipher suite configuration best balances compatibility and security?
Select an answer first
18application · medium
A developer is implementing a client-server application that must authenticate the server to the client and then encrypt the session. The developer wants to avoid the overhead of asymmetric encryption for the bulk data. Which approach should the developer use?
Select an answer first
19expert · hard
A multinational company operates an IPsec VPN between two data centers. The security team must rotate the pre-shared keys (PSKs) used for IKE authentication. The rotation must not cause a significant outage, and the team wants to maintain the same tunnel endpoints. Which approach should they take?
Select an answer first
20application · medium
A network administrator needs to connect two remote branch offices over the internet. The traffic between them includes legacy protocols that cannot be modified to use TLS. The administrator wants to encrypt all traffic between the two sites without changing the applications. Which solution should be implemented?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Network Data Encryption GMON Practice Questions (Page 4)

Questions 16–20

A security engineer is configuring TLS for a high-traffic e-commerce site. The site must support a wide range of clients, including older browsers, but the security team wants to avoid known weak ciphers. Which cipher suite configuration best balances compatibility and security?

A developer is implementing a client-server application that must authenticate the server to the client and then encrypt the session. The developer wants to avoid the overhead of asymmetric encryption for the bulk data. Which approach should the developer use?

A multinational company operates an IPsec VPN between two data centers. The security team must rotate the pre-shared keys (PSKs) used for IKE authentication. The rotation must not cause a significant outage, and the team wants to maintain the same tunnel endpoints. Which approach should they take?

Keep studying — Data Protection