A company needs to securely transfer a large file to a partner. The file is sensitive, and the company wants to ensure that the partner can verify the file's integrity and origin. The company also wants to avoid the complexity of managing a PKI. Which approach is most appropriate?

Use a pre-shared key to encrypt the file and rely on the partner's knowledge of the key to verify origin.

Encrypt the file with a symmetric key and send the key to the partner over a separate secure channel, along with a hash of the file.

Use a digital signature with a certificate from a public CA, and encrypt the file with the partner's public key.

Use a hash of the file and publish it on a public website.

A security analyst needs to ensure that a configuration file downloaded from an internal server has not been tampered with during transmission. The file is not confidential, but integrity is critical. Which action best meets this requirement?

Rely on the server's HTTPS certificate to ensure the file is unchanged.

Encrypt the file with AES-256 before sending it.

Use a digital signature, but only if the file is encrypted first.

Compute a SHA-256 hash of the file and compare it to a published hash after download.

An organization is planning to deploy a private PKI for internal applications. The security team is concerned about the risk of a compromised root CA. They want to minimize the impact of a root CA compromise while keeping the operational overhead reasonable. Which design is most appropriate?

Use a public CA to issue all internal certificates.

Keep the root CA offline and issue certificates from an intermediate CA that is online.

Use the root CA directly to issue all end-entity certificates.

Store the root CA private key on a server that is accessible to all internal users.

An organization wants to deploy TLS for its internal web applications. They need to ensure that clients can verify the identity of the servers without manually trusting each certificate. Which component is essential for this to work?

A key distribution center (KDC) that distributes session keys to clients.

A Diffie-Hellman key exchange to authenticate the server.

A certificate authority (CA) that issues and signs the server certificates.

A certificate revocation list (CRL) that is distributed with every certificate.

GIAC Security Essentials

Domain 3Objective 2

Cryptography Application GSEC Practice Questions (Page 6)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 26–30

26foundation · easy
What does a digital signature provide that a simple hash alone does not?
Select an answer first
27expert · hard
A company needs to securely transfer a large file to a partner. The file is sensitive, and the company wants to ensure that the partner can verify the file's integrity and origin. The company also wants to avoid the complexity of managing a PKI. Which approach is most appropriate?
Select an answer first
28application · medium
A security analyst needs to ensure that a configuration file downloaded from an internal server has not been tampered with during transmission. The file is not confidential, but integrity is critical. Which action best meets this requirement?
Select an answer first
29expert · hard
An organization is planning to deploy a private PKI for internal applications. The security team is concerned about the risk of a compromised root CA. They want to minimize the impact of a root CA compromise while keeping the operational overhead reasonable. Which design is most appropriate?
Select an answer first
30application · medium
An organization wants to deploy TLS for its internal web applications. They need to ensure that clients can verify the identity of the servers without manually trusting each certificate. Which component is essential for this to work?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.