A security engineer needs to ensure that a configuration file downloaded by clients is authentic and has not been tampered with. The file is distributed over an insecure channel. Which scripting approach should the engineer use?

Encrypt the file with AES-256 using a password shared with all clients.

Compress the file and append a CRC32 checksum to the archive.

Compute a SHA-256 hash of the file and publish it on the same web server.

Sign the file with the engineer's RSA private key and distribute the signature and public key via a trusted channel.

A security analyst is investigating a suspected malware infection. The malware modifies a system binary, and the analyst wants to verify the integrity of the binary against a known-good hash. The analyst has the original SHA-256 hash from the vendor. Which action should the analyst take?

Check the file's digital signature using the vendor's private key.

Run the binary in a sandbox and observe its behavior to determine if it is malicious.

Decrypt the binary using the vendor's public key and compare the result to the original.

Compute the SHA-256 of the current binary and compare it to the vendor's hash.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 4Objective 1

Practical Cryptography GXPN Practice Questions (Page 2)

Part of the Offensive Scripting and Cryptography domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 6–10

6foundation · easy
Which of the following is a common cryptographic attack that involves intercepting and potentially altering communications between two parties?
Select an answer first
7application · medium
A security engineer needs to ensure that a configuration file downloaded by clients is authentic and has not been tampered with. The file is distributed over an insecure channel. Which scripting approach should the engineer use?
Select an answer first
8foundation · easy
What property of a cryptographic hash function ensures that it is computationally infeasible to find two different inputs that produce the same hash output?
Select an answer first
9foundation · easy
In Python, which library is commonly used for cryptographic operations such as hashing and encryption?
Select an answer first
10application · easy
A security analyst is investigating a suspected malware infection. The malware modifies a system binary, and the analyst wants to verify the integrity of the binary against a known-good hash. The analyst has the original SHA-256 hash from the vendor. Which action should the analyst take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Practical Cryptography GXPN Practice Questions (Page 2)

Questions 6–10

Which of the following is a common cryptographic attack that involves intercepting and potentially altering communications between two parties?

A security engineer needs to ensure that a configuration file downloaded by clients is authentic and has not been tampered with. The file is distributed over an insecure channel. Which scripting approach should the engineer use?

What property of a cryptographic hash function ensures that it is computationally infeasible to find two different inputs that produce the same hash output?

In Python, which library is commonly used for cryptographic operations such as hashing and encryption?

A security analyst is investigating a suspected malware infection. The malware modifies a system binary, and the analyst wants to verify the integrity of the binary against a known-good hash. The analyst has the original SHA-256 hash from the vendor. Which action should the analyst take?

Keep studying — Offensive Scripting and Cryptography