A security architect is designing a new TLS deployment for a government agency that requires compliance with CNSA (Commercial National Security Algorithm) Suite. The agency must support both internal and external clients. Which cipher suite configuration aligns with CNSA requirements?

Use AES-128-GCM and ECDHE with P-256

Use ChaCha20-Poly1305 and ECDHE with Curve25519

Use AES-256-GCM for bulk encryption, ECDHE with P-384 for key exchange, and SHA-384 for integrity

Use RSA-2048 for key exchange and SHA-256 for integrity

A security operations center monitors outbound HTTPS traffic. They need to inspect the content of encrypted traffic for data exfiltration, but they must also comply with GDPR and avoid breaking end-to-end encryption for customer-facing applications. Which approach best balances these requirements?

Use passive monitoring of TLS handshake metadata only

Deploy a TLS-intercepting proxy only for traffic to non-customer internal systems and exclude customer-facing domains

Intercept all HTTPS traffic and store decrypted payloads for 90 days

Disable TLS inspection and rely on firewall logs

A security team is managing encryption keys for a large enterprise. They use a key management system (KMS) to store keys. A compliance audit requires that keys be rotated every 90 days. However, some legacy applications cannot handle key rotation without downtime. What is the best approach to meet the requirement while minimizing disruption?

Use dual-key versions in the KMS, allowing applications to use the old key until they are updated to support rotation.

Rotate all keys at once and accept the downtime for legacy applications.

Exempt legacy applications from the rotation requirement.

Store keys in plaintext in the application configuration to avoid rotation issues.

A security analyst is monitoring encrypted traffic and notices that a client is using a weak cipher suite (TLS_RSA_WITH_AES_128_CBC_SHA) to connect to an internal server. The analyst wants to enforce stronger security without breaking compatibility with legacy clients that do not support TLS 1.3. Which action should the analyst take?

Disable TLS 1.2 and only allow TLS 1.3

Allow the weak cipher but log a warning

Use a self-signed certificate to force the client to upgrade

Configure the server to only allow TLS 1.2 with ECDHE and AES-GCM cipher suites

A company needs to securely transfer files between its internal servers and a partner's server over the internet. The files contain sensitive customer data. Which protocol should be used to ensure encryption of the data in transit?

SFTP (SSH File Transfer Protocol)

HTTP (Hypertext Transfer Protocol)

TFTP (Trivial File Transfer Protocol)

GIAC Continuous Monitoring Certification

Domain 7Objective 1

Network Data Encryption GMON Practice Questions (Page 7)

Part of the Data Protection domain, which makes up ~7% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 31–35

31expert · hard
A security architect is designing a new TLS deployment for a government agency that requires compliance with CNSA (Commercial National Security Algorithm) Suite. The agency must support both internal and external clients. Which cipher suite configuration aligns with CNSA requirements?
Select an answer first
32expert · hard
A security operations center monitors outbound HTTPS traffic. They need to inspect the content of encrypted traffic for data exfiltration, but they must also comply with GDPR and avoid breaking end-to-end encryption for customer-facing applications. Which approach best balances these requirements?
Select an answer first
33expert · hard
A security team is managing encryption keys for a large enterprise. They use a key management system (KMS) to store keys. A compliance audit requires that keys be rotated every 90 days. However, some legacy applications cannot handle key rotation without downtime. What is the best approach to meet the requirement while minimizing disruption?
Select an answer first
34expert · hard
A security analyst is monitoring encrypted traffic and notices that a client is using a weak cipher suite (TLS_RSA_WITH_AES_128_CBC_SHA) to connect to an internal server. The analyst wants to enforce stronger security without breaking compatibility with legacy clients that do not support TLS 1.3. Which action should the analyst take?
Select an answer first
35application · medium
A company needs to securely transfer files between its internal servers and a partner's server over the internet. The files contain sensitive customer data. Which protocol should be used to ensure encryption of the data in transit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.

Network Data Encryption GMON Practice Questions (Page 7)

Questions 31–35

A security architect is designing a new TLS deployment for a government agency that requires compliance with CNSA (Commercial National Security Algorithm) Suite. The agency must support both internal and external clients. Which cipher suite configuration aligns with CNSA requirements?

A security operations center monitors outbound HTTPS traffic. They need to inspect the content of encrypted traffic for data exfiltration, but they must also comply with GDPR and avoid breaking end-to-end encryption for customer-facing applications. Which approach best balances these requirements?

A company needs to securely transfer files between its internal servers and a partner's server over the internet. The files contain sensitive customer data. Which protocol should be used to ensure encryption of the data in transit?

Keep studying — Data Protection