What is the primary purpose of the Diffie-Hellman key exchange protocol?

To allow two parties to agree on a shared secret key over an insecure channel

To encrypt data using a shared secret key

To compress data before transmission

To authenticate the identity of a remote server

A security analyst is investigating a potential collision attack on a system that uses MD5 to verify software updates. The analyst wants to demonstrate the practical impact of MD5's weakness. Which attack should the analyst perform?

Perform a brute-force attack to find the original file from its hash.

Use a length extension attack to append data to the file.

Generate two different files with the same MD5 hash, one benign and one malicious.

Use a padding oracle to decrypt the hash.

Which of the following is a mitigation for side-channel attacks?

Implementing constant-time algorithms

A legal team requires proof that a specific employee approved a financial document. The document is stored in a system that uses digital signatures. What must be true for the signature to provide non-repudiation?

The document is encrypted with the employee's public key.

The document is hashed with MD5 before signing.

The signature is verified with the employee's private key.

The employee's private key is kept secret and only used by the employee.

A penetration tester is analyzing a custom protocol that uses AES-128 in ECB mode to encrypt each block of a message independently. The tester notices that the same plaintext block always produces the same ciphertext block. Which attack is most effective?

Chosen-plaintext attack to reveal patterns in the plaintext

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 4Objective 1

Practical Cryptography GXPN Practice Questions (Page 6)

Part of the Offensive Scripting and Cryptography domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 7–11 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 26–30

26foundation · easy
What is the primary purpose of the Diffie-Hellman key exchange protocol?
Select an answer first
27expert · hard
A security analyst is investigating a potential collision attack on a system that uses MD5 to verify software updates. The analyst wants to demonstrate the practical impact of MD5's weakness. Which attack should the analyst perform?
Select an answer first
28foundation · easy
Which of the following is a mitigation for side-channel attacks?
Select an answer first
29application · medium
A legal team requires proof that a specific employee approved a financial document. The document is stored in a system that uses digital signatures. What must be true for the signature to provide non-repudiation?
Select an answer first
30expert · hard
A penetration tester is analyzing a custom protocol that uses AES-128 in ECB mode to encrypt each block of a message independently. The tester notices that the same plaintext block always produces the same ciphertext block. Which attack is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.