Two servers need to exchange sensitive configuration data over a private network. They use a pre-shared key for encryption. The security team wants to minimize the risk of key compromise. Which practice is most important?

Use a longer key, such as AES-256, to make brute-force attacks infeasible.

Store the key in a plaintext file on both servers with read-only permissions.

Rotate the pre-shared key on a regular schedule and use a secure channel to distribute the new key.

Use the same key for all servers to simplify management.

A company processes credit card data and must comply with PCI DSS. They are designing a new payment page. Which combination of controls is required?

Encrypt cardholder data at rest but transmit it over HTTP to reduce latency.

Use only HTTPS for the payment page and store card numbers in plaintext for faster processing.

Use TLS for all data transmission and encrypt stored cardholder data at rest.

Use TLS but allow SSL 3.0 for older browsers to ensure compatibility.

A company is implementing a secure messaging system. They need to ensure that messages are confidential and that recipients can verify the sender's identity. They also want to minimize the performance impact of encrypting large messages. Which approach should they use?

Use AES with a shared static key distributed to all users.

Use RSA to encrypt the entire message directly.

Use TLS for message confidentiality and rely on the server to authenticate users.

Use hybrid encryption: encrypt the message with a random symmetric key (AES), then encrypt that key with the recipient's RSA public key.

A company processes personal data of EU citizens and must comply with GDPR. They store data in a cloud database. Which measure is required to protect the data at rest?

Anonymize all personal data so that encryption is not necessary.

Store the data only in an EU region to satisfy data residency requirements.

Encrypt the database using a customer-managed key stored in a cloud KMS.

Use a private cloud to ensure that the data is not accessible to the public.

GIAC Certified Web Application Defender

Domain 5Objective 2

Encryption and Protecting Sensitive Data GWEB Practice Questions (Page 9)

Part of the Security Testing and Cryptography domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 41–45

41application · medium
Two servers need to exchange sensitive configuration data over a private network. They use a pre-shared key for encryption. The security team wants to minimize the risk of key compromise. Which practice is most important?
Select an answer first
42application · medium
A company processes credit card data and must comply with PCI DSS. They are designing a new payment page. Which combination of controls is required?
Select an answer first
43foundation · easy
In asymmetric encryption, which key is used to encrypt data that only the intended recipient can decrypt?
Select an answer first
44expert · hard
A company is implementing a secure messaging system. They need to ensure that messages are confidential and that recipients can verify the sender's identity. They also want to minimize the performance impact of encrypting large messages. Which approach should they use?
Select an answer first
45application · medium
A company processes personal data of EU citizens and must comply with GDPR. They store data in a cloud database. Which measure is required to protect the data at rest?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWEB

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWEB” is a trademark of its owner, used for identification only.