A company is implementing network segmentation to protect its critical servers. The security team wants to ensure that even if one segment is compromised, the attacker cannot move laterally to other segments. Which control is most effective in achieving this?

Use internal firewalls between segments with default-deny rules and allow only specific required traffic.

Deploy a network access control (NAC) solution to authenticate devices before they join the network.

Enable port security on switches to limit the number of MAC addresses per port.

Use VLANs without any inter-VLAN routing restrictions.

During routine monitoring, an analyst sees a large amount of outbound traffic from a server that normally sends very little traffic. The traffic is encrypted and going to an unfamiliar external IP. The analyst suspects the server may be compromised. What is the first response action the analyst should take?

Isolate the server from the network while preserving forensic data

Ignore the traffic because it is encrypted and cannot be analyzed

Block the external IP at the firewall and continue monitoring

Shut down the server immediately

A company wants to prevent lateral movement within its internal network. They have deployed an internal firewall and segmented the network into VLANs. What additional control would most effectively limit lateral movement?

Enable host-based firewalls on all endpoints with default-deny rules

Deploy a network intrusion detection system (IDS)

Use a single strong password for all administrative accounts

Which component is essential for a network monitoring solution to capture and analyze traffic data?

A packet capture sensor or flow collector

In a security operations context, what is the primary purpose of network monitoring?

To observe and analyze network traffic to detect anomalies, threats, and policy violations

To ensure the network operates at maximum speed at all times

To replace the need for firewalls and other security controls

To automatically block all suspicious traffic without human intervention

GIAC Critical Controls Certification

Domain 5Objective 3

Network Monitoring and Defense GCCC Practice Questions (Page 8)

Part of the Security Operations and Monitoring domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 36–40

36expert · hard
A company is implementing network segmentation to protect its critical servers. The security team wants to ensure that even if one segment is compromised, the attacker cannot move laterally to other segments. Which control is most effective in achieving this?
Select an answer first
37application · medium
During routine monitoring, an analyst sees a large amount of outbound traffic from a server that normally sends very little traffic. The traffic is encrypted and going to an unfamiliar external IP. The analyst suspects the server may be compromised. What is the first response action the analyst should take?
Select an answer first
38application · medium
A company wants to prevent lateral movement within its internal network. They have deployed an internal firewall and segmented the network into VLANs. What additional control would most effectively limit lateral movement?
Select an answer first
39foundation · easy
Which component is essential for a network monitoring solution to capture and analyze traffic data?
Select an answer first
40foundation · easy
In a security operations context, what is the primary purpose of network monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.