A company's web application handles sensitive user data. The security team wants to ensure that data is encrypted in transit between the user's browser and the web server. Which configuration is necessary?

Install a valid TLS certificate on the web server and enforce HTTPS connections.

Use IPsec on the web server's network interface.

Encrypt the database where the data is stored.

Use a VPN on the user's device to access the web application.

A financial services firm is deploying a new customer portal that will transmit sensitive personal data over the internet. The compliance team requires that data be encrypted in transit using a protocol that provides both confidentiality and integrity. Which protocol should the development team use?

TLS 1.2 or higher with a strong cipher suite

During an incident involving a potential encryption key compromise, what action should be taken to protect encrypted data?

Keep the same keys to avoid disruption.

Disable encryption to simplify access.

Publish the keys to prove transparency.

Rotate the affected keys and re-encrypt data with new keys.

A company is implementing a new remote access solution for employees. The solution must encrypt all traffic between the employee's device and the corporate network, and it must also support multi-factor authentication. Which technology should the company choose?

IPsec VPN with certificate-based authentication and an additional factor.

SSH tunneling with key-based authentication.

TLS-based VPN with username and password only.

HTTPS with client certificates.

During a routine audit, a company discovers that a database containing customer personal data was encrypted with a deprecated encryption algorithm. The data is still accessible, but the algorithm is no longer considered secure. What is the most appropriate response?

Document the risk and plan to re-encrypt during the next scheduled maintenance window.

Disable access to the database until the encryption is updated.

Immediately re-encrypt the database with a modern algorithm and rotate the encryption keys.

Ignore the issue because the data is encrypted, even if the algorithm is weak.

GIAC Security Leadership

Domain 4Objective 2

Managing Encryption and Privacy GSLC Practice Questions (Page 3)

Part of the Cryptography and Privacy domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 11–15

11application · medium
A company's web application handles sensitive user data. The security team wants to ensure that data is encrypted in transit between the user's browser and the web server. Which configuration is necessary?
Select an answer first
12application · medium
A financial services firm is deploying a new customer portal that will transmit sensitive personal data over the internet. The compliance team requires that data be encrypted in transit using a protocol that provides both confidentiality and integrity. Which protocol should the development team use?
Select an answer first
13foundation · easy
During an incident involving a potential encryption key compromise, what action should be taken to protect encrypted data?
Select an answer first
14expert · hard
A company is implementing a new remote access solution for employees. The solution must encrypt all traffic between the employee's device and the corporate network, and it must also support multi-factor authentication. Which technology should the company choose?
Select an answer first
15expert · hard
During a routine audit, a company discovers that a database containing customer personal data was encrypted with a deprecated encryption algorithm. The data is still accessible, but the algorithm is no longer considered secure. What is the most appropriate response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.