A company is implementing a site-to-site VPN between two offices. The VPN must support the use of multicast traffic for a video conferencing application. The security team requires that all traffic be encrypted. Which VPN technology should be used?

IPsec in transport mode with AH, carrying GRE inside the tunnel.

IPsec in tunnel mode with ESP, carrying GRE inside the tunnel.

GRE tunnel with no encryption, relying on the internet service provider's MPLS backbone.

SSL VPN using a web browser for each office.

A security analyst is reviewing firewall logs and notices a large number of ICMP echo requests from a single external IP to multiple internal hosts. The requests are all sourced from the same IP and are hitting hosts across several subnets. The analyst wants to block this activity while still allowing necessary ICMP for path MTU discovery. Which action should be taken?

Block all ICMP traffic from the external IP using an ACL.

Block all ICMP echo requests at the perimeter firewall.

Rate-limit ICMP echo requests per source IP and allow ICMP fragmentation-needed messages.

Enable uRPF on the internal interfaces to drop spoofed ICMP packets.

A security team is reviewing firewall rules for ICMP. They want to allow necessary ICMP types for troubleshooting (echo request/reply, destination unreachable, time exceeded) but block potentially dangerous types like redirect and router advertisement. They also want to prevent ICMP-based tunneling. Which approach best meets these requirements?

Use a stateful firewall to allow ICMP only for established connections

Allow all ICMP types from trusted sources only

Block all ICMP traffic entirely

Create ACLs that permit specific ICMP types (echo, destination-unreachable, time-exceeded) and deny all other ICMP

GIAC Defensible Security Architect

Domain 2Objective 2

Fundamental Layer 3 Defense GDSA Practice Questions (Page 4)

Part of the Network Security Fundamentals domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

Questions 16–20

16application · medium
A company is implementing a site-to-site VPN between two offices. The VPN must support the use of multicast traffic for a video conferencing application. The security team requires that all traffic be encrypted. Which VPN technology should be used?
Select an answer first
17application · medium
A security analyst is reviewing firewall logs and notices a large number of ICMP echo requests from a single external IP to multiple internal hosts. The requests are all sourced from the same IP and are hitting hosts across several subnets. The analyst wants to block this activity while still allowing necessary ICMP for path MTU discovery. Which action should be taken?
Select an answer first
18foundation · easy
A network engineer is designing a secure segment for 200 hosts. Which CIDR notation provides the smallest subnet that accommodates all hosts with minimal waste?
Select an answer first
19application · easy
A network architect is designing a new DMZ segment for public-facing servers. The servers need to be isolated from the internal corporate network. The available address space is 192.168.10.0/24. They want to create four equal-sized subnets for different server tiers (web, app, db, management). What subnet mask should they use?
Select an answer first
20expert · medium
A security team is reviewing firewall rules for ICMP. They want to allow necessary ICMP types for troubleshooting (echo request/reply, destination unreachable, time exceeded) but block potentially dangerous types like redirect and router advertisement. They also want to prevent ICMP-based tunneling. Which approach best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Fundamental Layer 3 Defense GDSA Practice Questions (Page 4)

Questions 16–20

A company is implementing a site-to-site VPN between two offices. The VPN must support the use of multicast traffic for a video conferencing application. The security team requires that all traffic be encrypted. Which VPN technology should be used?

A network engineer is designing a secure segment for 200 hosts. Which CIDR notation provides the smallest subnet that accommodates all hosts with minimal waste?

Keep studying — Network Security Fundamentals