A software vendor distributes a signed update file. A customer downloads the file and wants to verify that it was not tampered with during transit and that it genuinely came from the vendor. What should the customer do?

Compare the file's hash to a hash posted on the vendor's website.

Check the file size and version number against the release notes.

Verify the digital signature using the vendor's public key from a trusted certificate.

Decrypt the file using the vendor's private key.

A company's security policy requires that encryption keys be rotated annually. The IT team is concerned about the operational overhead of re-encrypting all data with new keys. Which approach allows key rotation without re-encrypting the underlying data?

Store the old key and continue using it until the data is naturally retired.

Re-encrypt all data with a new symmetric key during the rotation window.

Keep the same key but change the algorithm to a stronger one.

Use envelope encryption: encrypt data with a data encryption key (DEK) and wrap the DEK with a key encryption key (KEK).

A security manager is comparing symmetric and asymmetric encryption for a new project. Which statement correctly differentiates the two?

Asymmetric encryption requires a secure channel to share the key, while symmetric does not.

Symmetric encryption is slower than asymmetric encryption for large data volumes.

Symmetric encryption provides non-repudiation, while asymmetric does not.

Symmetric encryption uses a single shared key for both encryption and decryption, while asymmetric uses a public/private key pair.

A company needs to securely exchange data with a partner. The partner is not technically sophisticated and cannot manage certificates. The data is not highly sensitive but must be protected from casual interception. The company wants to minimize complexity for the partner. Which approach is most appropriate?

Use a pre-shared symmetric key exchanged through a secure out-of-band channel.

Use asymmetric encryption with the partner's public key.

Send data in plaintext and rely on the transport layer.

Implement a full PKI with certificates for the partner.

Which management decision is most directly influenced by the need to balance security with usability when implementing encryption?

Choosing between full-disk encryption and file-level encryption

Deciding whether to use a public or private cloud provider

Determining the color scheme of the encryption software interface

Selecting the brand of hardware used for key storage

GIAC Security Leadership

Domain 4Objective 1

Cryptography Concepts for Managers GSLC Practice Questions (Page 8)

Part of the Cryptography and Privacy domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

8concepts

Questions 36–40

36application · medium
A software vendor distributes a signed update file. A customer downloads the file and wants to verify that it was not tampered with during transit and that it genuinely came from the vendor. What should the customer do?
Select an answer first
37application · medium
A company's security policy requires that encryption keys be rotated annually. The IT team is concerned about the operational overhead of re-encrypting all data with new keys. Which approach allows key rotation without re-encrypting the underlying data?
Select an answer first
38foundation · easy
A security manager is comparing symmetric and asymmetric encryption for a new project. Which statement correctly differentiates the two?
Select an answer first
39expert · hard
A company needs to securely exchange data with a partner. The partner is not technically sophisticated and cannot manage certificates. The data is not highly sensitive but must be protected from casual interception. The company wants to minimize complexity for the partner. Which approach is most appropriate?
Select an answer first
40foundation · easy
Which management decision is most directly influenced by the need to balance security with usability when implementing encryption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.