A company's web application uses TLS certificates issued by an internal certificate authority (CA). Recently, a developer's laptop was compromised, and the attacker obtained the CA's private key. What is the most immediate risk to the organization?

The attacker can decrypt all past TLS traffic that used certificates issued by that CA.

The attacker can issue fraudulent certificates for any domain, allowing them to impersonate the company's websites.

The attacker can modify the code of the web application.

The attacker can steal user credentials from the web application's database.

A security manager is explaining to a new analyst the core purpose of cryptography in an organization. Which statement best describes the primary goal of confidentiality in cryptography?

Ensuring that data cannot be altered without detection

Providing proof that a message was sent by a specific sender

Preventing unauthorized parties from reading the data

Verifying the identity of a user or system

A security manager is reviewing the organization's cryptographic controls and discovers that the same RSA key pair has been used for both TLS server certificates and code signing for over five years. Which risk does this practice introduce?

Inability to revoke the key if one use is compromised.

Increased risk of key compromise due to prolonged exposure and broader impact if compromised.

Non-compliance with industry standards that require separate keys for different purposes.

Reduced performance because RSA is slower than symmetric encryption.

An organization is implementing a PKI to issue certificates for internal applications. The security manager wants to ensure that if a certificate is compromised, it can be revoked quickly and that clients will reject it. What is the most important control to implement?

Issue certificates only to administrators to minimize the attack surface.

Maintain a certificate revocation list (CRL) and ensure clients check it.

Use long certificate validity periods to reduce the frequency of re-issuance.

Store all private keys in a software vault on each server.

Why is regular rotation of cryptographic keys important for an organization's security posture?

To comply with the requirement that keys must be stored in plaintext for audit purposes

To ensure that all employees can access the encrypted data without needing individual credentials

To make encryption faster by using newer algorithms

To reduce the amount of data encrypted with any single key, limiting the impact of a key compromise

GIAC Security Leadership

Domain 4Objective 1

Cryptography Concepts for Managers GSLC Practice Questions (Page 2)

Part of the Cryptography and Privacy domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 6–10

6application · medium
A company's web application uses TLS certificates issued by an internal certificate authority (CA). Recently, a developer's laptop was compromised, and the attacker obtained the CA's private key. What is the most immediate risk to the organization?
Select an answer first
7foundation · easy
A security manager is explaining to a new analyst the core purpose of cryptography in an organization. Which statement best describes the primary goal of confidentiality in cryptography?
Select an answer first
8application · medium
A security manager is reviewing the organization's cryptographic controls and discovers that the same RSA key pair has been used for both TLS server certificates and code signing for over five years. Which risk does this practice introduce?
Select an answer first
9application · medium
An organization is implementing a PKI to issue certificates for internal applications. The security manager wants to ensure that if a certificate is compromised, it can be revoked quickly and that clients will reject it. What is the most important control to implement?
Select an answer first
10foundation · easy
Why is regular rotation of cryptographic keys important for an organization's security posture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.