What is the primary purpose of the Diffie-Hellman key exchange protocol?

To allow two parties to agree on a shared secret key over an insecure channel

To generate public and private key pairs

To encrypt data using a shared secret key

To authenticate users using digital certificates

A small business wants to encrypt files stored on a shared network drive. Employees need to access the files from multiple devices, and the business wants to minimize the complexity of key management. Which approach is most appropriate?

Use a hash function to protect the files and store the hashes on the drive.

Use a symmetric encryption tool with a single shared passphrase that all employees enter to access the files.

Use asymmetric encryption and have each employee encrypt files with their own public key.

Use a digital signature to encrypt the files.

A developer is designing a system where users submit documents and the system must prove that a specific user submitted a specific document at a later time. The system does not need to keep the document secret. Which cryptographic approach should the developer use?

Use a symmetric key shared with the user to encrypt the document and store the key.

Encrypt the document with the user's public key and store the ciphertext.

Have the user sign the document's hash with their private key and store the signature with the document.

Store the document's hash in a database with the user's username.

A company wants to deploy a private PKI for internal services. They need to ensure that clients can automatically trust certificates issued by the internal CA. What is the most efficient way to achieve this?

Have clients manually approve each server certificate when they connect.

Install the internal CA's root certificate in the trusted root store of all client machines.

Use a public CA to sign the internal CA's certificate.

Distribute the private key of the internal CA to all clients.

A security engineer is designing a system to store user passwords. The system must resist offline brute-force attacks even if the password database is leaked. The engineer also wants to avoid the overhead of a key management system. Which approach is most appropriate?

Use a digital signature to sign each password with a server private key.

Use SHA-256 with a unique salt for each password.

Use AES-256 encryption with a key stored in a hardware security module (HSM).

Use bcrypt with a high cost factor and a unique salt per password.

GIAC Security Essentials

Domain 3Objective 2

Cryptography Application GSEC Practice Questions (Page 3)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 11–15

11foundation · easy
What is the primary purpose of the Diffie-Hellman key exchange protocol?
Select an answer first
12application · easy
A small business wants to encrypt files stored on a shared network drive. Employees need to access the files from multiple devices, and the business wants to minimize the complexity of key management. Which approach is most appropriate?
Select an answer first
13application · medium
A developer is designing a system where users submit documents and the system must prove that a specific user submitted a specific document at a later time. The system does not need to keep the document secret. Which cryptographic approach should the developer use?
Select an answer first
14application · medium
A company wants to deploy a private PKI for internal services. They need to ensure that clients can automatically trust certificates issued by the internal CA. What is the most efficient way to achieve this?
Select an answer first
15expert · hard
A security engineer is designing a system to store user passwords. The system must resist offline brute-force attacks even if the password database is leaked. The engineer also wants to avoid the overhead of a key management system. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.