A security architect is designing a VPN for a remote user who needs access to a single internal application. The user's device is not managed by the organization. The architect must ensure that the VPN provides confidentiality and integrity, but also wants to minimize the attack surface and the amount of internal network exposed. Which approach is most appropriate?

Use a full-tunnel VPN that routes all the user's traffic through the corporate gateway.

Use a split-tunnel VPN that routes only traffic destined for the internal application through the VPN tunnel.

Use an SSL VPN that provides access to the entire internal network.

Use IPsec with transport mode and no encryption.

A network administrator is setting up IPsec between two routers. The administrator wants to ensure that the symmetric keys used for the IPsec session are generated fresh for each session and that the key exchange itself is protected against man-in-the-middle attacks. Which IPsec feature should be used?

Static symmetric keys configured manually on both routers.

Internet Key Exchange (IKE) with Diffie-Hellman and authentication using pre-shared keys or certificates.

Authentication Header (AH) with a pre-shared key.

Encapsulating Security Payload (ESP) in transport mode without IKE.

GIAC Security Essentials

Domain 3Objective 2

Cryptography Application GSEC Practice Questions (Page 9)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

8concepts

Questions 41–42

41expert · hard
A security architect is designing a VPN for a remote user who needs access to a single internal application. The user's device is not managed by the organization. The architect must ensure that the VPN provides confidentiality and integrity, but also wants to minimize the attack surface and the amount of internal network exposed. Which approach is most appropriate?
Select an answer first
42application · medium
A network administrator is setting up IPsec between two routers. The administrator wants to ensure that the symmetric keys used for the IPsec session are generated fresh for each session and that the key exchange itself is protected against man-in-the-middle attacks. Which IPsec feature should be used?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Cryptography Application GSEC Practice Questions (Page 9)

Questions 41–42

Keep studying — Cryptography and Communications