Network Data Encryption GMON Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A multinational company is subject to GDPR and must protect personal data in transit. They have offices in the EU and the US. They use TLS for web traffic and IPsec for internal links. A new GDPR requirement mandates that data transfers to the US must be protected with 'appropriate safeguards'. What is the most important consideration?

   • AUse a VPN with IPsec to encrypt all traffic between the EU and US offices.
   • BImplement a data transfer impact assessment and use standard contractual clauses (SCCs) for the US transfers.
   • CEnsure that the encryption used is strong enough to be considered an appropriate safeguard, such as AES-256.
   • DMove all data processing to the EU to avoid international transfers.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which practice is considered a best practice for storing encryption keys?

   • AEmbedding keys in application source code for convenience.
   • BStoring keys in a hardware security module (HSM) or a dedicated key management service.
   • CStoring keys in the same database as the encrypted data for easy access.
   • DSharing keys among team members via email for quick access.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A financial company is required by PCI-DSS to encrypt cardholder data in transit. They use TLS for external communications and IPsec for internal site-to-site links. The security team wants to ensure that if one key is compromised, the exposure is limited. Which key management practice best addresses this requirement?

   • AUse a separate key for each TLS session and each IPsec security association
   • BStore all keys in a central database accessible to all servers
   • CUse the same long-term key for all TLS sessions to simplify management
   • DRotate keys only when a compromise is suspected
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security analyst is investigating a potential man-in-the-middle attack on a TLS connection. The analyst notices that the server certificate is valid but the certificate chain includes an unexpected intermediate CA. What should the analyst do first?

   • ADisable TLS on the client to avoid the risk of interception.
   • BImmediately block the server's IP address to prevent further data exposure.
   • CCheck the certificate's Subject and Issuer fields to see if the intermediate CA is legitimate.
   • DChange the client's trust store to trust the unexpected CA.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which statement correctly differentiates symmetric and asymmetric encryption?

   • ASymmetric encryption uses a single shared key for both encryption and decryption, while asymmetric encryption uses a pair of public and private keys.
   • BSymmetric encryption is slower than asymmetric encryption for the same amount of data.
   • CSymmetric encryption provides stronger security than asymmetric encryption.
   • DAsymmetric encryption requires a pre-shared secret key to be exchanged securely.
   Reveal Solution Discussion Select an answer first