A security architect is designing a system to store user passwords. The team wants to resist both offline brute-force and rainbow table attacks. They also want to minimize the risk of hash collisions. Which approach is best?

Use AES encryption with a key stored in the database

Use a unique salt per user with a slow, memory-hard hash function like Argon2

Why is key length an important consideration in key management?

Shorter keys are more secure because they are easier to manage.

Longer keys provide a larger keyspace, making brute-force attacks more difficult.

Longer keys are always faster to use.

Key length determines the type of encryption algorithm used.

A company is deploying a new web application that handles sensitive customer data. The security architect is choosing between TLS and IPsec to protect the data. The application is accessed via a browser, and the company also needs to protect internal database traffic between servers. Which approach is the most appropriate?

Use TLS for both the web application and the database traffic.

Use TLS for the web application and IPsec for the internal database traffic.

Use IPsec for both the web application and the database traffic.

Use SSH tunneling for the web application and TLS for the database.

A company is deploying a new system that requires both encryption of data in transit and digital signatures for audit logs. The system runs on low-power IoT devices. The team must minimize CPU usage while maintaining security. Which combination is most appropriate?

Use RSA-4096 for both encryption and signatures

Use ECC for key exchange and signatures, and AES for symmetric encryption

Use AES for both encryption and signatures

Use SHA-256 for encryption and RSA for signatures

A remote worker needs to securely access internal web applications and file shares from a laptop over the internet. The company wants to minimize the attack surface and avoid exposing internal services directly to the internet. Which solution is most appropriate?

Use a VPN client that establishes an IPsec tunnel to the company's VPN gateway.

Set up an SSH tunnel to a jump host inside the network.

Expose the internal web applications through a reverse proxy with TLS.

Use a remote desktop protocol (RDP) directly over the internet.

GIAC Security Essentials

Domain 3Objective 1

Cryptography GSEC Practice Questions (Page 6)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

7concepts

Questions 26–30

26expert · hard
A security architect is designing a system to store user passwords. The team wants to resist both offline brute-force and rainbow table attacks. They also want to minimize the risk of hash collisions. Which approach is best?
Select an answer first
27foundation · easy
Why is key length an important consideration in key management?
Select an answer first
28expert · hard
A company is deploying a new web application that handles sensitive customer data. The security architect is choosing between TLS and IPsec to protect the data. The application is accessed via a browser, and the company also needs to protect internal database traffic between servers. Which approach is the most appropriate?
Select an answer first
29expert · hard
A company is deploying a new system that requires both encryption of data in transit and digital signatures for audit logs. The system runs on low-power IoT devices. The team must minimize CPU usage while maintaining security. Which combination is most appropriate?
Select an answer first
30application · medium
A remote worker needs to securely access internal web applications and file shares from a laptop over the internet. The company wants to minimize the attack surface and avoid exposing internal services directly to the internet. Which solution is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.