Which of the following is a method for protecting data at rest?

Implementing full-disk encryption on servers

Enforcing strong password policies

Using a web application firewall (WAF)

Using TLS for all network communications

A company uses asymmetric encryption to secure email communications. The private key of the CEO is stored on a laptop that is encrypted with BitLocker. The security team wants to ensure that the private key is not exposed if the laptop is stolen. Which additional control is most effective?

Store the private key on a hardware security module (HSM) or smart card instead of the laptop's hard drive.

Use a longer RSA key, such as 4096 bits, to make it harder to brute-force.

Encrypt the private key with a password and store the password in the laptop's password manager.

Regularly rotate the CEO's key pair and revoke the old key.

What is the primary purpose of encryption in the context of protecting sensitive data?

To convert plaintext into ciphertext so that unauthorized parties cannot read it

To compress data so it takes up less storage space

To ensure data integrity by detecting unauthorized modifications

To authenticate the sender of a message using digital signatures

A development team is storing user passwords in a database. They currently use a plain SHA-256 hash without a salt. A security review recommends improving password storage. Which change should the team implement?

Use AES encryption with a key stored in the application configuration file.

Use a per-user random salt with a slow, adaptive hashing algorithm such as bcrypt or Argon2.

Use a keyed hash (HMAC) with a static application-wide secret.

Use double SHA-256 with a global salt shared by all users.

A security team is investigating a potential downgrade attack on their TLS configuration. They notice that the server supports TLS 1.2 and TLS 1.3, but also has SSLv3 enabled for legacy clients. An attacker could force a client to use SSLv3. Which mitigation is most effective?

Use TLS 1.2 with a weak cipher suite to match SSLv3 performance.

Keep SSLv3 enabled but require a strong cipher suite.

Implement a server-side fallback to SSLv3 only when the client requests it.

Disable SSLv3 and all earlier protocol versions on the server.

GIAC Certified Web Application Defender

Domain 5Objective 2

Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 4)

Part of the Security Testing and Cryptography domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 16–20

16foundation · easy
Which of the following is a method for protecting data at rest?
Select an answer first
17expert · hard
A company uses asymmetric encryption to secure email communications. The private key of the CEO is stored on a laptop that is encrypted with BitLocker. The security team wants to ensure that the private key is not exposed if the laptop is stolen. Which additional control is most effective?
Select an answer first
18foundation · easy
What is the primary purpose of encryption in the context of protecting sensitive data?
Select an answer first
19application · medium
A development team is storing user passwords in a database. They currently use a plain SHA-256 hash without a salt. A security review recommends improving password storage. Which change should the team implement?
Select an answer first
20expert · hard
A security team is investigating a potential downgrade attack on their TLS configuration. They notice that the server supports TLS 1.2 and TLS 1.3, but also has SSLv3 enabled for legacy clients. An attacker could force a client to use SSLv3. Which mitigation is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.