A network intrusion detection system alerts on suspicious traffic from a compromised workstation to a database server in the internal network. The incident response team has confirmed the workstation is compromised. What should be the immediate containment step?

Isolate the compromised workstation from the network by disabling its switch port or applying a quarantine VLAN.

Rebuild the workstation immediately from a known-good image.

Shut down the database server to protect it from further access.

Increase logging verbosity on the firewall to capture more details.

Which authentication method adds an extra layer of security beyond a username and password for network device access?

Simple Network Management Protocol (SNMP)

Multi-factor authentication (MFA)

A security team is prioritizing patches for network devices. The team has identified three vulnerabilities: (1) a critical RCE in a firewall, (2) a high-severity DoS in a switch, and (3) a moderate information-disclosure in a load balancer. The firewall is internet-facing, the switch is internal, and the load balancer is in the DMZ. Which patch should the team apply first?

The switch DoS, because it could affect internal network availability.

All three at the same time, to minimize the window of exposure.

The firewall RCE, because it is critical and the firewall is internet-facing.

The load balancer information disclosure, because it is in the DMZ.

GIAC Critical Controls Certification

Domain 6Objective 3

Network Infrastructure Management GCCC Practice Questions (Page 10)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 46–49

46foundation · easy
Which phase of incident response involves removing the root cause of the incident from affected network devices?
Select an answer first
47application · medium
A network intrusion detection system alerts on suspicious traffic from a compromised workstation to a database server in the internal network. The incident response team has confirmed the workstation is compromised. What should be the immediate containment step?
Select an answer first
48foundation · easy
Which authentication method adds an extra layer of security beyond a username and password for network device access?
Select an answer first
49expert · hard
A security team is prioritizing patches for network devices. The team has identified three vulnerabilities: (1) a critical RCE in a firewall, (2) a high-severity DoS in a switch, and (3) a moderate information-disclosure in a load balancer. The firewall is internet-facing, the switch is internal, and the load balancer is in the DMZ. Which patch should the team apply first?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Network Infrastructure Management GCCC Practice Questions (Page 10)

Questions 46–49

Which phase of incident response involves removing the root cause of the incident from affected network devices?

A network intrusion detection system alerts on suspicious traffic from a compromised workstation to a database server in the internal network. The incident response team has confirmed the workstation is compromised. What should be the immediate containment step?

Which authentication method adds an extra layer of security beyond a username and password for network device access?

Keep studying — Application and Network Security