A security analyst is reviewing logs from a firewall and notices that a large number of failed SSH login attempts are coming from a single external IP address. The attempts are targeting the management interface of the firewall. What should the analyst do first?

Ignore the attempts because they are just automated scans.

Block the external IP address at the firewall and review the logs for any successful logins.

Change the firewall's management password immediately.

Disable SSH on the firewall and use the console port for management.

A network administrator is configuring a new switch that will be deployed in a branch office. The switch will be managed remotely over the corporate network. Which set of actions should the administrator take to secure the management plane?

Enable SNMPv2c with a community string and allow management from any source IP.

Use the default VLAN for management and enable HTTP for the web interface.

Disable all unused ports and enable port security on access ports.

Change the default credentials, disable Telnet, enable SSH, and configure an ACL to restrict management access to authorized admin subnets.

Why should unnecessary services be disabled on network devices?

To simplify the device's configuration file

To reduce the attack surface of the device

To increase the device's processing speed

To comply with licensing agreements

What is the primary purpose of network segmentation?

To isolate sensitive systems and limit the spread of attacks

To improve the speed of individual network connections

To eliminate the need for firewalls in the network

To increase the number of available IP addresses on a network

A company's network team wants to enforce least privilege for router administration. The team has three administrators: one who needs full configuration access, one who needs to view configurations but not change them, and one who needs to reboot the router during maintenance. Which access control approach should the team implement?

Create three RBAC roles: network-admin, network-operator (read-only), and network-maintenance (reboot only).

Use the default 'admin' account for all three and rely on the router's built-in privilege levels.

Provide read-only access to all three and escalate to full access when needed.

Give all three administrators the same full administrative account.

GIAC Critical Controls Certification

Domain 6Objective 3

Network Infrastructure Management GCCC Practice Questions (Page 9)

Part of the Application and Network Security domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 41–45

41application · medium
A security analyst is reviewing logs from a firewall and notices that a large number of failed SSH login attempts are coming from a single external IP address. The attempts are targeting the management interface of the firewall. What should the analyst do first?
Select an answer first
42application · medium
A network administrator is configuring a new switch that will be deployed in a branch office. The switch will be managed remotely over the corporate network. Which set of actions should the administrator take to secure the management plane?
Select an answer first
43foundation · easy
Why should unnecessary services be disabled on network devices?
Select an answer first
44foundation · easy
What is the primary purpose of network segmentation?
Select an answer first
45application · medium
A company's network team wants to enforce least privilege for router administration. The team has three administrators: one who needs full configuration access, one who needs to view configurations but not change them, and one who needs to reboot the router during maintenance. Which access control approach should the team implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.