A startup is building a mobile app that stores sensitive user data on the device. They want to protect the data with encryption. Which approach is most secure?

Hardcode a symmetric key in the app's source code.

Use the device's hardware-backed keystore to generate and store a symmetric key, and encrypt data with AES.

Use RSA to encrypt all data directly.

Use a key derived from the user's password without a salt.

A company uses a cloud KMS to encrypt data at rest. The security policy requires that keys be rotated every 90 days and that old keys be retained for at least one year to decrypt archived data. The operations team wants to automate rotation. Which approach best meets these requirements?

Manually generate a new key every 90 days and delete the old key immediately after rotation.

Enable automatic key rotation in the KMS and configure the retention period for old key versions to one year.

Store the keys in a database and rotate them by updating the database records.

Use a single key and re-encrypt all data with the same key every 90 days.

A web application is hosted behind a load balancer that terminates TLS. The application itself receives plaintext HTTP traffic from the load balancer. The security team is concerned about the risk of data exposure. Which action is most effective?

Use a self-signed certificate on the load balancer to avoid the cost of a public certificate.

Disable TLS termination at the load balancer and enable TLS directly on the application servers.

Configure the load balancer to use a strong TLS policy and ensure the connection between the load balancer and application servers is on a private network.

Encrypt the traffic between the load balancer and application servers using a VPN.

GIAC Certified Web Application Defender

Domain 5Objective 2

Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 7)

Part of the Security Testing and Cryptography domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 31–35

31foundation · easy
Which term describes the process of converting ciphertext back into readable plaintext using the appropriate key?
Select an answer first
32application · medium
A startup is building a mobile app that stores sensitive user data on the device. They want to protect the data with encryption. Which approach is most secure?
Select an answer first
33expert · hard
A company uses a cloud KMS to encrypt data at rest. The security policy requires that keys be rotated every 90 days and that old keys be retained for at least one year to decrypt archived data. The operations team wants to automate rotation. Which approach best meets these requirements?
Select an answer first
34foundation · easy
What property does a digital signature provide that encryption alone does not?
Select an answer first
35application · medium
A web application is hosted behind a load balancer that terminates TLS. The application itself receives plaintext HTTP traffic from the load balancer. The security team is concerned about the risk of data exposure. Which action is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.

Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 7)

Questions 31–35

Which term describes the process of converting ciphertext back into readable plaintext using the appropriate key?

A startup is building a mobile app that stores sensitive user data on the device. They want to protect the data with encryption. Which approach is most secure?

A company uses a cloud KMS to encrypt data at rest. The security policy requires that keys be rotated every 90 days and that old keys be retained for at least one year to decrypt archived data. The operations team wants to automate rotation. Which approach best meets these requirements?

What property does a digital signature provide that encryption alone does not?

A web application is hosted behind a load balancer that terminates TLS. The application itself receives plaintext HTTP traffic from the load balancer. The security team is concerned about the risk of data exposure. Which action is most effective?

Keep studying — Security Testing and Cryptography