An administrator is configuring a web server that will host multiple domains on the same IP address. The administrator needs to ensure that each domain has its own valid certificate and that clients can negotiate the correct certificate during the TLS handshake. Which configuration is required?

Configure the server to use the same certificate for all domains.

Use Server Name Indication (SNI) to select the correct certificate based on the domain name.

Use a wildcard certificate for all domains.

Disable TLS and use HTTP for all domains.

What is a downgrade attack in the context of web communication?

An attacker removes security headers from HTTP responses

An attacker forces the client and server to use an older, less secure version of TLS

An attacker reduces the quality of images on a web page

An attacker lowers the privilege level of a user account

A security engineer is reviewing the HTTP response headers of a web application. The application allows users to upload profile pictures, and the engineer is concerned about stored XSS. Which header configuration would best mitigate the risk of an attacker serving malicious content from the upload endpoint?

Set Cache-Control: no-store on the upload response.

Set Strict-Transport-Security: max-age=31536000 on the upload response.

Set Content-Security-Policy: default-src 'none'; img-src 'self' data: on the upload response.

Set X-Frame-Options: DENY on the upload response.

What is the primary purpose of the TLS handshake in securing web communications?

To compress HTTP requests to reduce bandwidth usage

To block malicious HTTP requests before they reach the web server

To authenticate the server and establish session keys for encrypted communication

To encrypt the web server's database contents

What is the purpose of the Strict-Transport-Security (HSTS) header?

To instruct the browser to only communicate with the server over HTTPS

To prevent the browser from caching sensitive data

To encrypt the content of the web page

To block cross-site scripting attacks

GIAC Security Essentials

Domain 3Objective 3

Web Communication Security GSEC Practice Questions (Page 6)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

7concepts

Questions 26–30

26application · medium
An administrator is configuring a web server that will host multiple domains on the same IP address. The administrator needs to ensure that each domain has its own valid certificate and that clients can negotiate the correct certificate during the TLS handshake. Which configuration is required?
Select an answer first
27foundation · easy
What is a downgrade attack in the context of web communication?
Select an answer first
28application · medium
A security engineer is reviewing the HTTP response headers of a web application. The application allows users to upload profile pictures, and the engineer is concerned about stored XSS. Which header configuration would best mitigate the risk of an attacker serving malicious content from the upload endpoint?
Select an answer first
29foundation · easy
What is the primary purpose of the TLS handshake in securing web communications?
Select an answer first
30foundation · easy
What is the purpose of the Strict-Transport-Security (HSTS) header?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.