An organization is migrating to a new cloud-based document signing service. The legal team requires that signatures be legally binding and that the signer cannot later deny having signed. The service uses a shared symmetric key for all signatures. What is the main flaw with this approach?

A shared symmetric key does not provide non-repudiation because any party with the key could have created the signature.

Symmetric encryption is too slow for signing documents.

Symmetric keys are too short to provide adequate security.

Symmetric keys cannot be used to create digital signatures.

A network administrator needs to securely connect two office networks over the internet. The traffic includes all IP protocols, not just web traffic. Which protocol is the best fit?

AES encryption at the application layer

A company issues laptops to employees. The IT department wants to ensure that only company-issued laptops can connect to the corporate VPN. Which approach best achieves this?

Rely on the laptop's MAC address for authentication

Use a shared username and password for all employees

Install a unique client certificate on each laptop and require it during VPN authentication

Allow any device that knows the VPN server's IP address

A developer is building a chat application and wants to encrypt messages between users. The users do not share a secret in advance. Which approach should the developer use?

Use AES with a hardcoded key in the application

Use RSA to encrypt the entire message directly

Use SHA-256 to encrypt messages

Use a key exchange protocol like Diffie-Hellman to establish a shared symmetric key

A company needs to secure communications between a web server and a database server in the same data center. They also need to secure remote administrative access from the internet. Which combination of protocols is most appropriate?

SSH for web-to-database traffic and TLS for administration

AES encryption at the application layer for both

TLS for web-to-database traffic and SSH for remote administration

IPsec for web-to-database traffic and Telnet for administration

GIAC Security Essentials

Domain 3Objective 1

Cryptography GSEC Practice Questions (Page 4)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

7concepts

Questions 16–20

16expert · hard
An organization is migrating to a new cloud-based document signing service. The legal team requires that signatures be legally binding and that the signer cannot later deny having signed. The service uses a shared symmetric key for all signatures. What is the main flaw with this approach?
Select an answer first
17application · medium
A network administrator needs to securely connect two office networks over the internet. The traffic includes all IP protocols, not just web traffic. Which protocol is the best fit?
Select an answer first
18application · medium
A company issues laptops to employees. The IT department wants to ensure that only company-issued laptops can connect to the corporate VPN. Which approach best achieves this?
Select an answer first
19application · medium
A developer is building a chat application and wants to encrypt messages between users. The users do not share a secret in advance. Which approach should the developer use?
Select an answer first
20expert · hard
A company needs to secure communications between a web server and a database server in the same data center. They also need to secure remote administrative access from the internet. Which combination of protocols is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.