A company stores user passwords in a database. To reduce the risk of password disclosure if the database is breached, the security team decides to store only a salted hash of each password. Which property of cryptographic hash functions makes this approach effective?

Avalanche effect: a small change in the password produces a completely different hash.

Pre-image resistance: it is computationally infeasible to recover the original password from the hash.

Determinism: the same password always produces the same hash, allowing verification.

Collision resistance: two different passwords cannot produce the same hash.

A company is setting up a new web server for public-facing HTTPS. They want to ensure that clients can verify the server's identity without browser warnings. They also want to minimize the risk of certificate compromise. Which approach is most appropriate?

Use a certificate signed by a peer server's private key.

Purchase a certificate from a public CA and install it on the server.

Use a certificate from an internal CA and distribute the root certificate to all potential clients.

Generate a self-signed certificate and install it on the server.

A security administrator discovers that a private key corresponding to a public certificate used for TLS has been compromised. What is the immediate action the administrator should take to prevent further misuse?

Delete the private key from the server and continue using the certificate.

Use the certificate only for encryption, not for signing.

Revoke the certificate and add it to the certificate revocation list (CRL).

Reissue the same certificate with a new serial number.

What is the primary function of a certificate authority (CA) in a PKI?

To store users' private keys securely

To perform key exchange on behalf of users

To issue and digitally sign digital certificates

To encrypt all network traffic between clients and servers

GIAC Security Essentials

Domain 3Objective 2

Cryptography Application GSEC Practice Questions (Page 1)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 1–5

1application · medium
A company stores user passwords in a database. To reduce the risk of password disclosure if the database is breached, the security team decides to store only a salted hash of each password. Which property of cryptographic hash functions makes this approach effective?
Select an answer first
2expert · medium
A company is setting up a new web server for public-facing HTTPS. They want to ensure that clients can verify the server's identity without browser warnings. They also want to minimize the risk of certificate compromise. Which approach is most appropriate?
Select an answer first
3foundation · easy
Which protocol is designed to secure IP communications by encrypting and authenticating each IP packet?
Select an answer first
4application · medium
A security administrator discovers that a private key corresponding to a public certificate used for TLS has been compromised. What is the immediate action the administrator should take to prevent further misuse?
Select an answer first
5foundation · easy
What is the primary function of a certificate authority (CA) in a PKI?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.