A financial institution must protect customer data at rest in a database. They are considering using application-level encryption to encrypt specific columns. The compliance team requires that encryption keys be managed by the institution and not by the cloud provider. Which solution best meets these requirements?

Use a cloud KMS with customer-managed keys (CMK) and integrate it with the database's native encryption features.

Generate keys on-premises and store them in a configuration file on the application server.

Use a cloud provider-managed key and rely on the provider's security controls.

Use a hardware security module (HSM) on-premises and have the application send encryption requests to it over the network.

A development team is implementing encryption for a new application. They need to choose a symmetric encryption algorithm and a key management strategy. Which of the following are considered best practices? (Select all that apply.)

Rotate encryption keys regularly and securely distribute new keys.

Use AES-256 in GCM mode for authenticated encryption.

Use the same key for all encryption operations to simplify management.

Store encryption keys in the same database as the encrypted data.

Use a unique IV for each encryption operation.

What is the primary purpose of Transport Layer Security (TLS) in web applications?

To encrypt data transmitted between a client and a server

To authenticate users using passwords

To encrypt data stored in a database

To prevent SQL injection attacks

A company uses a symmetric key to encrypt sensitive files. The key is stored on a network share accessible to several administrators. The security team wants to improve key management. Which change is most effective?

Use a longer key (e.g., AES-256 instead of AES-128) to compensate for the insecure storage.

Encrypt the key with a password and share the password with all administrators via email.

Move the key to a hardware security module (HSM) and restrict access to a small set of administrators.

Change the key every year and store the old keys in an archive folder.

What is the purpose of file-level encryption?

To encrypt the entire hard drive including the operating system

To hash files to verify integrity

To encrypt individual files or directories so that only authorized users can access them

To encrypt network traffic between two hosts

GIAC Certified Web Application Defender

Domain 5Objective 2

Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 1)

Part of the Security Testing and Cryptography domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 1–5

1expert · hard
A financial institution must protect customer data at rest in a database. They are considering using application-level encryption to encrypt specific columns. The compliance team requires that encryption keys be managed by the institution and not by the cloud provider. Which solution best meets these requirements?
Select an answer first
2expert · hard · select all that apply
A development team is implementing encryption for a new application. They need to choose a symmetric encryption algorithm and a key management strategy. Which of the following are considered best practices? (Select all that apply.)
Select an answer first
3foundation · easy
What is the primary purpose of Transport Layer Security (TLS) in web applications?
Select an answer first
4application · medium
A company uses a symmetric key to encrypt sensitive files. The key is stored on a network share accessible to several administrators. The security team wants to improve key management. Which change is most effective?
Select an answer first
5foundation · easy
What is the purpose of file-level encryption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.