A network administrator is configuring a web server to support TLS 1.2 and TLS 1.3. The server currently uses a certificate with an RSA 2048-bit key. Which cipher suite should be prioritized for TLS 1.3 connections?

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

Which regulation specifically requires the protection of cardholder data during transmission over open, public networks?

GDPR (General Data Protection Regulation)

PCI-DSS (Payment Card Industry Data Security Standard)

HIPAA (Health Insurance Portability and Accountability Act)

What is the primary weakness of the DES (Data Encryption Standard) algorithm that led to its deprecation?

It is an asymmetric algorithm that is too slow for bulk encryption.

Its 56-bit key size is too small to resist modern brute-force attacks.

It does not support authentication.

It is a stream cipher that is prone to bit-flipping attacks.

A security analyst is troubleshooting a TLS 1.3 connection that fails to establish. The client and server both support TLS 1.3, but the handshake fails with a certificate error. The server certificate is signed by a private CA that is not installed on the client. Which action should the analyst take to resolve the issue?

Downgrade the server to TLS 1.2

Install the private CA certificate in the client's trust store

Disable certificate validation on the client

Change the server to use a self-signed certificate

A security team is implementing a key management policy for a hybrid cloud environment. They use a cloud KMS for keys used in the cloud and an on-premises HSM for on-premises keys. A compliance requirement mandates that keys be rotated every 30 days. What is the best practice to ensure compliance?

Exempt cloud keys from rotation because they are managed by the cloud provider.

Automate key rotation in both the cloud KMS and the on-premises HSM, and ensure that applications can use multiple key versions.

Rotate keys manually every 30 days to ensure compliance.

Use the same key for both cloud and on-premises to simplify rotation.

GIAC Continuous Monitoring Certification

Domain 7Objective 1

Network Data Encryption GMON Practice Questions (Page 8)

Part of the Data Protection domain, which makes up ~7% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~5–8 in this domain), expect 5–8 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

9concepts

Questions 36–40

36application · medium
A network administrator is configuring a web server to support TLS 1.2 and TLS 1.3. The server currently uses a certificate with an RSA 2048-bit key. Which cipher suite should be prioritized for TLS 1.3 connections?
Select an answer first
37foundation · easy
Which regulation specifically requires the protection of cardholder data during transmission over open, public networks?
Select an answer first
38foundation · easy
What is the primary weakness of the DES (Data Encryption Standard) algorithm that led to its deprecation?
Select an answer first
39expert · medium
A security analyst is troubleshooting a TLS 1.3 connection that fails to establish. The client and server both support TLS 1.3, but the handshake fails with a certificate error. The server certificate is signed by a private CA that is not installed on the client. Which action should the analyst take to resolve the issue?
Select an answer first
40expert · hard
A security team is implementing a key management policy for a hybrid cloud environment. They use a cloud KMS for keys used in the cloud and an on-premises HSM for on-premises keys. A compliance requirement mandates that keys be rotated every 30 days. What is the best practice to ensure compliance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GMON

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMON” is a trademark of its owner, used for identification only.