A company is deploying a public web application and wants to protect it from common web attacks such as SQL injection and cross-site scripting. The application is hosted on a cloud platform and uses a load balancer. The security team wants a solution that can automatically update its rules as new vulnerabilities are discovered. Which approach best meets these requirements?

Use a cloud-managed WAF service that is integrated with the load balancer and provides managed rule sets.

Enable TLS 1.3 and use strong ciphers on the load balancer.

Configure the load balancer to only allow traffic from known IP addresses.

Set HTTP response headers like X-Frame-Options and CSP on the application.

A system administrator is configuring a new web server for a public-facing site. The site will handle sensitive customer data. The administrator wants to enforce that clients always use HTTPS and cannot fall back to HTTP. Which configuration should be applied?

Disable TLS 1.0 and enable TLS 1.2 only.

Install a valid certificate from a public CA.

Configure the server to listen on port 443 and close port 80.

Redirect all HTTP requests to HTTPS and add the HSTS header with a long max-age.

A security analyst is troubleshooting a TLS handshake failure. The client and server both support TLS 1.2, but the handshake fails. The server's certificate is valid and trusted. The analyst checks the server logs and finds that the client is offering a cipher suite that the server does not support. What is the most likely cause of the failure?

The client is using a different TLS version than the server.

The client and server do not share a common cipher suite.

The server's private key does not match the certificate.

The server's certificate has expired.

A user on a public Wi-Fi network connects to a website that supports both HTTP and HTTPS. An attacker on the same network intercepts the initial HTTP request and redirects the user to a look-alike site that uses a self-signed certificate. The user's browser displays a certificate warning, but the user clicks through. What is the primary security control that would have prevented this attack?

A Web Application Firewall (WAF) in front of the legitimate site

HTTP Strict Transport Security (HSTS) on the legitimate site

Content Security Policy (CSP) with default-src 'self'

A longer RSA key on the legitimate site's certificate

GIAC Security Essentials

Domain 3Objective 3

Web Communication Security GSEC Practice Questions (Page 8)

Part of the Cryptography and Communications domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

7concepts

Questions 36–40

36application · medium
A company is deploying a public web application and wants to protect it from common web attacks such as SQL injection and cross-site scripting. The application is hosted on a cloud platform and uses a load balancer. The security team wants a solution that can automatically update its rules as new vulnerabilities are discovered. Which approach best meets these requirements?
Select an answer first
37application · medium
A system administrator is configuring a new web server for a public-facing site. The site will handle sensitive customer data. The administrator wants to enforce that clients always use HTTPS and cannot fall back to HTTP. Which configuration should be applied?
Select an answer first
38expert · hard
A security analyst is troubleshooting a TLS handshake failure. The client and server both support TLS 1.2, but the handshake fails. The server's certificate is valid and trusted. The analyst checks the server logs and finds that the client is offering a cipher suite that the server does not support. What is the most likely cause of the failure?
Select an answer first
39foundation · easy
Which attack involves an attacker intercepting and potentially altering the communication between a client and server without either party knowing?
Select an answer first
40application · medium
A user on a public Wi-Fi network connects to a website that supports both HTTP and HTTPS. An attacker on the same network intercepts the initial HTTP request and redirects the user to a look-alike site that uses a self-signed certificate. The user's browser displays a certificate warning, but the user clicks through. What is the primary security control that would have prevented this attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Web Communication Security GSEC Practice Questions (Page 8)

Questions 36–40

A system administrator is configuring a new web server for a public-facing site. The site will handle sensitive customer data. The administrator wants to enforce that clients always use HTTPS and cannot fall back to HTTP. Which configuration should be applied?

Which attack involves an attacker intercepting and potentially altering the communication between a client and server without either party knowing?

Keep studying — Cryptography and Communications