GIAC Certified Enterprise Defender
Domain 1Objective 1
Defending Network Protocols GCED Practice Questions (Page 2)
Part of the Network Defense and Monitoring domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~24–41 in this domain), expect 6–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)
43questions here
9free pages
5concepts
Questions 6–10
- 6
A network defender is troubleshooting a server that is intermittently unreachable. Packet captures show that the server is receiving TCP SYN packets, but it is not sending SYN-ACK responses. The server's connection table is full. Which attack is most likely causing this, and what is the best immediate mitigation?
Select an answer first - 7
A security team wants to prevent an attacker from using a rogue DHCP server to assign malicious IP configurations to clients. Which switch feature should be enabled to block unauthorized DHCP offers?
Select an answer first - 8
A network defender is using Wireshark to analyze a suspicious capture. The capture shows a client sending a DHCP discover message, but the server's offer is not reaching the client. The defender notices that the DHCP offer is being sent to the broadcast address, but the client's firewall is blocking broadcast traffic. What is the most likely reason the client is not receiving the offer?
Select an answer first - 9
Which protocol is used to resolve a known IP address to a corresponding MAC address on a local network?
Select an answer first - 10
A security administrator is hardening a corporate network against ARP spoofing attacks. The network uses dynamic ARP inspection (DAI) on the switches, but the administrator wants to add a defense-in-depth layer. Which additional control would most effectively mitigate ARP spoofing at the host level?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.