A company wants to secure its web application against protocol-based attacks. The application is currently served over HTTP. Which configuration change would most directly mitigate eavesdropping and man-in-the-middle attacks on the protocol?

Use a web application firewall (WAF) to filter HTTP requests

Enable HTTP Strict Transport Security (HSTS) only

Disable HTTP keep-alive connections

Implement HTTPS with TLS 1.2 or higher

A network defender is investigating a series of successful attacks on internal servers. The common thread is that the attacks originate from a single external IP, but the packets show different source IPs. The defender suspects IP spoofing. Which mitigation would be most effective at the network perimeter?

Use network address translation (NAT) to hide internal IPs

Deploy a stateful firewall that only allows established connections

Implement egress filtering to block packets with source IPs outside the internal network

Implement ingress filtering to block packets with source IPs outside the internal network

A company wants to protect its internal DNS infrastructure from cache poisoning attacks. Which configuration should be implemented on the DNS servers?

Increase the TTL on all DNS records

Use a public DNS resolver for all internal queries

Disable recursion on all internal DNS servers

Enable DNSSEC validation and signing

A security analyst is investigating a network breach and notices that a server's ARP cache has been modified to point the gateway IP to an attacker's MAC address. The analyst also sees that the server is sending outbound traffic to an external IP that is not in the approved list. Which attack is most likely occurring?

ARP poisoning combined with traffic interception

A security analyst is examining a packet capture and sees a series of TCP packets with the SYN flag set and the ACK flag set in the same packet, but the sequence numbers are not in the expected range. The packets are being sent to a server that is not expecting a connection. What is the most likely explanation?

The packets are part of a normal TCP handshake

The server is experiencing a TCP SYN flood

The packets indicate a TCP session hijack

A TCP SYN-ACK scan is being used to probe the server

GIAC Certified Enterprise Defender

Domain 1Objective 1

Defending Network Protocols GCED Practice Questions (Page 8)

Part of the Network Defense and Monitoring domain, which makes up ~34% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~24–41 in this domain), expect 6–10 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 36–40

36application · medium
A company wants to secure its web application against protocol-based attacks. The application is currently served over HTTP. Which configuration change would most directly mitigate eavesdropping and man-in-the-middle attacks on the protocol?
Select an answer first
37expert · hard
A network defender is investigating a series of successful attacks on internal servers. The common thread is that the attacks originate from a single external IP, but the packets show different source IPs. The defender suspects IP spoofing. Which mitigation would be most effective at the network perimeter?
Select an answer first
38application · medium
A company wants to protect its internal DNS infrastructure from cache poisoning attacks. Which configuration should be implemented on the DNS servers?
Select an answer first
39expert · hard
A security analyst is investigating a network breach and notices that a server's ARP cache has been modified to point the gateway IP to an attacker's MAC address. The analyst also sees that the server is sending outbound traffic to an external IP that is not in the approved list. Which attack is most likely occurring?
Select an answer first
40application · medium
A security analyst is examining a packet capture and sees a series of TCP packets with the SYN flag set and the ACK flag set in the same packet, but the sequence numbers are not in the expected range. The packets are being sent to a server that is not expecting a connection. What is the most likely explanation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.

Defending Network Protocols GCED Practice Questions (Page 8)

Questions 36–40

A company wants to secure its web application against protocol-based attacks. The application is currently served over HTTP. Which configuration change would most directly mitigate eavesdropping and man-in-the-middle attacks on the protocol?

A company wants to protect its internal DNS infrastructure from cache poisoning attacks. Which configuration should be implemented on the DNS servers?

Keep studying — Network Defense and Monitoring