A developer is designing a password storage mechanism for a new web application. They want to store passwords in a way that resists offline brute-force attacks. Which approach should they choose?

Use a keyed hash function like HMAC-SHA256 with a static application-wide secret.

Hash passwords with SHA-256 and store the hash directly in the database.

Use bcrypt with a per-user random salt and a high work factor.

Encrypt passwords with AES-256 and store the encryption key in the application configuration file.

Why is it important to securely store cryptographic keys separately from the encrypted data?

To allow multiple users to share the same key

To comply with password complexity requirements

To make the encryption algorithm run faster

To ensure that a data breach does not also expose the keys needed to decrypt the data

What is the purpose of data protection regulations like GDPR in relation to encryption?

They require organizations to implement appropriate technical measures, such as encryption, to protect personal data

They only apply to government agencies

They prohibit the use of encryption for personal data

They mandate specific encryption algorithms that must be used

An organization uses a centralized key management service (KMS) to encrypt sensitive data. A developer accidentally exposes a data encryption key (DEK) in a log file. What is the best course of action?

Delete the log file and continue using the same DEK.

Disable the KMS and use a new KMS provider.

Change the KMS master key but keep the same DEK.

Rotate the DEK immediately and re-encrypt the data that was encrypted with the exposed key.

A security analyst is investigating a potential padding oracle vulnerability in a web application. The application uses AES-CBC with PKCS#7 padding. The analyst wants to confirm the vulnerability without causing a service disruption. Which test is most appropriate?

Review the source code to see if the application uses a random IV.

Send a modified ciphertext to the application and observe whether the error message differs between valid and invalid padding.

Attempt to brute-force the encryption key by sending many requests.

Check the TLS configuration to see if weak cipher suites are enabled.

GIAC Certified Web Application Defender

Domain 5Objective 2

Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 2)

Part of the Security Testing and Cryptography domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 6–10

6application · medium
A developer is designing a password storage mechanism for a new web application. They want to store passwords in a way that resists offline brute-force attacks. Which approach should they choose?
Select an answer first
7foundation · easy
Why is it important to securely store cryptographic keys separately from the encrypted data?
Select an answer first
8foundation · easy
What is the purpose of data protection regulations like GDPR in relation to encryption?
Select an answer first
9application · medium
An organization uses a centralized key management service (KMS) to encrypt sensitive data. A developer accidentally exposes a data encryption key (DEK) in a log file. What is the best course of action?
Select an answer first
10expert · hard
A security analyst is investigating a potential padding oracle vulnerability in a web application. The application uses AES-CBC with PKCS#7 padding. The analyst wants to confirm the vulnerability without causing a service disruption. Which test is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.