A security architect is designing a defense against DNS tunneling for a network that must allow external DNS queries. The team has limited budget and cannot deploy a full DNS security appliance. Which approach would provide the most effective detection with the least operational overhead?

Block all DNS queries to external servers and use an internal resolver

Monitor DNS query logs for unusual domain names and high query volumes

Use a firewall to block DNS over HTTPS (DoH)

Deploy a network intrusion detection system (IDS) with custom signatures

A network administrator wants to prevent an attacker from using the network to launch a Smurf attack. Which configuration should be applied on the routers?

Disable IP-directed broadcast forwarding

Disable ICMP echo replies on all interfaces

A security analyst is reviewing a packet capture and sees a client sending a DNS query to a local DNS server, but the response is coming from an external IP address. The analyst also notices that the client's ARP cache has an entry for the DNS server's IP pointing to an unknown MAC address. Which attack is most likely occurring?

A combination of ARP poisoning and DNS spoofing

GIAC Certified Enterprise Defender

Domain 1Objective 1

Defending Network Protocols GCED Practice Questions (Page 7)

Part of the Network Defense and Monitoring domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~24–41 in this domain), expect 6–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 31–35

31expert · hard
A security architect is designing a defense against DNS tunneling for a network that must allow external DNS queries. The team has limited budget and cannot deploy a full DNS security appliance. Which approach would provide the most effective detection with the least operational overhead?
Select an answer first
32application · medium
A network administrator notices that a switch is receiving frames with multiple different MAC addresses on a single port, and the MAC address table is filling up rapidly. Which attack is likely occurring?
Select an answer first
33application · medium
A network administrator wants to prevent an attacker from using the network to launch a Smurf attack. Which configuration should be applied on the routers?
Select an answer first
34foundation · easy
Which attack exploits the trust relationship in the TCP three-way handshake by predicting sequence numbers?
Select an answer first
35expert · hard
A security analyst is reviewing a packet capture and sees a client sending a DNS query to a local DNS server, but the response is coming from an external IP address. The analyst also notices that the client's ARP cache has an entry for the DNS server's IP pointing to an unknown MAC address. Which attack is most likely occurring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Defending Network Protocols GCED Practice Questions (Page 7)

Questions 31–35

A security architect is designing a defense against DNS tunneling for a network that must allow external DNS queries. The team has limited budget and cannot deploy a full DNS security appliance. Which approach would provide the most effective detection with the least operational overhead?

A network administrator notices that a switch is receiving frames with multiple different MAC addresses on a single port, and the MAC address table is filling up rapidly. Which attack is likely occurring?

A network administrator wants to prevent an attacker from using the network to launch a Smurf attack. Which configuration should be applied on the routers?

Which attack exploits the trust relationship in the TCP three-way handshake by predicting sequence numbers?

Keep studying — Network Defense and Monitoring