Two servers need to establish a secure TLS session. They want to use a key exchange method that provides forward secrecy, meaning that if the server's long-term private key is compromised in the future, past session keys remain secure. Which key exchange method should they choose?

Diffie-Hellman ephemeral (DHE) or ECDHE

A network engineer is configuring IPsec between two sites. The engineer wants to ensure that if one site's private key is compromised, past session keys cannot be recovered. Which IPsec setting should be enabled?

A long-lived Internet Security Association and Key Management Protocol (ISAKMP) SA with a static key.

Perfect Forward Secrecy (PFS) using a new Diffie-Hellman exchange for each session.

Pre-shared key authentication with a long key lifetime.

Using the same Diffie-Hellman group for all sessions without rekeying.

Which statement best describes symmetric encryption?

It uses a public key to encrypt and a private key to decrypt.

It uses two different keys, one for encryption and one for decryption.

It uses the same key for both encryption and decryption.

It uses a hash of the key to encrypt and the original key to decrypt.

A forensic investigator needs to prove that a log file has not been altered since it was collected. The investigator has the original hash of the log file, but the hash was stored on the same compromised system. Which additional step would strengthen the integrity evidence?

Encrypt the log file with a symmetric key and store the key on the same system.

Use a digital signature from the compromised system to sign the log file.

Store the hash in a write-once, read-many (WORM) storage or a trusted timestamping service.

Recompute the hash of the log file and compare it to the stored hash.

GIAC Security Essentials

Domain 3Objective 2

Cryptography Application GSEC Practice Questions (Page 2)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 6–10

6application · medium
Two servers need to establish a secure TLS session. They want to use a key exchange method that provides forward secrecy, meaning that if the server's long-term private key is compromised in the future, past session keys remain secure. Which key exchange method should they choose?
Select an answer first
7expert · hard
A network engineer is configuring IPsec between two sites. The engineer wants to ensure that if one site's private key is compromised, past session keys cannot be recovered. Which IPsec setting should be enabled?
Select an answer first
8foundation · easy
Which cryptographic protocol is commonly used to secure web browsing (HTTPS)?
Select an answer first
9foundation · easy
Which statement best describes symmetric encryption?
Select an answer first
10expert · hard
A forensic investigator needs to prove that a log file has not been altered since it was collected. The investigator has the original hash of the log file, but the hash was stored on the same compromised system. Which additional step would strengthen the integrity evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.