Which practice is considered a key management best practice for cryptographic keys?

Rotating keys on a defined schedule or when compromise is suspected.

Using the same key for all systems to simplify management.

Storing keys in the same location as the encrypted data for convenience.

Embedding keys directly in application source code for easy access.

A company's security policy requires that encryption keys be rotated annually and that the loss of a key must not result in permanent data loss. The IT team currently uses a single master key to wrap all data encryption keys. Which improvement best addresses the policy?

Store a copy of the master key in a safe deposit box at a bank.

Replace the master key with a longer key and extend the rotation period to five years.

Encrypt the master key with a passphrase known only to the CISO.

Use a hardware security module (HSM) to generate and store keys, and enable automatic annual rotation of the master key.

A global company is subject to GDPR and stores personal data in a cloud database. The database is encrypted at rest with keys managed by the cloud provider. The company's legal team is concerned about the provider's ability to access the data. Which approach would BEST address the legal team's concern while maintaining the ability to use the provider's database features?

Move the data to an on-premises database and encrypt it with a local key.

Rely on the cloud provider's default encryption and accept the risk.

Encrypt the data with application-level encryption before storing it in the cloud database.

Use customer-managed keys (CMK) with the cloud provider's key management service, and store the master key in the company's own HSM.

A security manager is explaining to a new analyst the basic difference between symmetric and asymmetric cryptography. Which statement correctly describes that difference?

Symmetric cryptography is used only for data at rest, while asymmetric is used only for data in transit.

Symmetric cryptography uses two different keys, while asymmetric cryptography uses the same key for both operations.

Symmetric cryptography is always faster than asymmetric, but asymmetric is always more secure.

Symmetric cryptography uses the same key for encryption and decryption, while asymmetric cryptography uses a pair of mathematically related keys.

What is the primary purpose of a data classification scheme in relation to encryption and privacy controls?

To assign ownership of data to specific individuals.

To determine the appropriate level of protection based on the sensitivity and regulatory requirements of the data.

To ensure all data is encrypted with the same algorithm.

To reduce the amount of data stored by deleting low-value information.

GIAC Security Leadership

Domain 4Objective 2

Managing Encryption and Privacy GSLC Practice Questions (Page 6)

Part of the Cryptography and Privacy domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
Which practice is considered a key management best practice for cryptographic keys?
Select an answer first
27application · medium
A company's security policy requires that encryption keys be rotated annually and that the loss of a key must not result in permanent data loss. The IT team currently uses a single master key to wrap all data encryption keys. Which improvement best addresses the policy?
Select an answer first
28expert · hard
A global company is subject to GDPR and stores personal data in a cloud database. The database is encrypted at rest with keys managed by the cloud provider. The company's legal team is concerned about the provider's ability to access the data. Which approach would BEST address the legal team's concern while maintaining the ability to use the provider's database features?
Select an answer first
29foundation · easy
A security manager is explaining to a new analyst the basic difference between symmetric and asymmetric cryptography. Which statement correctly describes that difference?
Select an answer first
30foundation · easy
What is the primary purpose of a data classification scheme in relation to encryption and privacy controls?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.