Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A web server is configured to support TLS 1.2 and TLS 1.3. The security team wants to ensure that clients cannot negotiate a weaker cipher suite. Which configuration is most appropriate?

   • AEnable all cipher suites and rely on the client to choose the strongest one.
   • BSet the server to prefer the client's cipher suite order.
   • CUse a certificate with a 2048-bit RSA key to ensure strong encryption.
   • DDisable all cipher suites that use RSA key exchange and enable only forward-secret cipher suites like ECDHE.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A financial institution uses a key management system to protect customer data. They are required to rotate keys annually, but they also need to maintain access to historical data encrypted with old keys. Which strategy should they implement?

   • AStore all keys in a database and rotate them by changing the key ID.
   • BUse envelope encryption: encrypt data with a data encryption key (DEK) and wrap the DEK with a key encryption key (KEK). Rotate the KEK annually and keep old KEKs for decryption.
   • CRe-encrypt all data with a new key every year and delete the old keys.
   • DUse a single long-lived key and never rotate it.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A company's website is being audited for PCI DSS compliance. The auditor finds that the server supports TLS 1.0 and uses RC4 cipher suites. What should the company do to pass the audit?

   • AUse RC4 with a longer key to improve security.
   • BEnable TLS 1.3 but keep RC4 as a fallback for older clients.
   • CKeep TLS 1.0 enabled but disable RC4 and use AES instead.
   • DDisable TLS 1.0 and RC4, and configure TLS 1.2 or higher with strong cipher suites.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which of the following is a common symmetric encryption algorithm?

   • AAES
   • BRSA
   • CSHA-256
   • DDiffie-Hellman
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A web application processes credit card payments and must comply with PCI DSS. The security team is configuring TLS for the public-facing site. They want to ensure that all client connections use strong encryption and that the server does not accept older, weaker protocols. Which configuration should they implement?

   • ADisable TLS entirely and rely on the application-level encryption of card data.
   • BEnable TLS 1.2 and TLS 1.3 only, and disable SSL 3.0 and TLS 1.0/1.1.
   • CEnable TLS 1.0 and TLS 1.1 for maximum client compatibility.
   • DEnable SSL 3.0 with strong cipher suites to maintain legacy support.
   Reveal Solution Discussion Select an answer first