GSEC Cryptography Practice Question
A security administrator is configuring a Linux server to encrypt a new block device that will store sensitive data. The administrator wants to ensure that data is encrypted at rest and that the encryption key is protected by a passphrase. Which of the following tools is designed specifically for this purpose?
⚠ Common exam trap
Many exam-takers confuse file-level encryption tools like GnuPG or eCryptfs with block-level encryption, which requires dm-crypt/LUKS for full disk encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
dm-crypt with LUKS
dm-crypt with LUKS is the standard Linux solution for block device encryption. dm-crypt provides the kernel-level encryption, while LUKS provides a standardized header and key management, allowing multiple passphrases to unlock the encryption key. This directly meets the requirement of encrypting a block device with a passphrase-protected key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
eCryptfs
Why it's wrong here
eCryptfs is a stacked cryptographic filesystem that encrypts files at the file level, not block devices. It is often used for home directory encryption. While it can encrypt data at rest, it operates on a per-file basis and does not provide the same block-level encryption as dm-crypt/LUKS. It also has different key management, often tied to user login passphrases.
- ✗
OpenSSL
Why it's wrong here
OpenSSL is a cryptographic library and toolkit used for TLS/SSL, certificate management, and general-purpose encryption. It can encrypt files but does not provide block device encryption or key management for full disk encryption. Using OpenSSL to encrypt a block device would require manual processes and lacks the integration and key management features of LUKS.
- ✓
dm-crypt with LUKS
Why this is correct
dm-crypt is a Linux kernel subsystem that provides transparent disk encryption, and LUKS (Linux Unified Key Setup) is a standard format for storing key material. Together, they allow encrypting a block device with a passphrase-protected key. LUKS manages multiple passphrases and stores metadata in the device header. This is the standard tool for full disk encryption on Linux.
- ✗
GnuPG (GPG)
Why it's wrong here
GnuPG is a tool for file and email encryption, digital signatures, and key management. It is not designed for full block device encryption. While it can encrypt files, it does not provide transparent encryption of a block device at rest. Therefore, it does not meet the requirement of encrypting a block device with a passphrase-protected key.
About these practice questions
One of 351 original GSEC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.