What is the primary role of a Layer 3 tunnel in network security?

To compress data to reduce bandwidth usage

To replace the need for firewalls at the network perimeter

To translate private IP addresses to public IP addresses

To encapsulate packets from one network protocol inside another to traverse an untrusted network

A company needs to connect two branch offices over the internet. The connection must support multicast traffic and dynamic routing protocols between the sites. The security team requires that all traffic be encrypted. Which tunneling approach should be used?

IPsec transport mode with AH, carrying GRE inside the tunnel.

SSL VPN using a web browser for each branch office.

GRE tunnel with no encryption, relying on the internet service provider's MPLS backbone.

IPsec tunnel mode with ESP, carrying GRE inside the tunnel.

A network team is migrating from OSPF to BGP for their enterprise core. They want to maintain security by preventing unauthorized route injection and ensuring that only valid internal prefixes are advertised to the upstream ISP. Which combination of BGP security features should they implement?

Use BGP community tags to mark internal routes and filter on the ISP side

Use BGP TTL security and rely on the ISP to filter routes

Disable BGP and use static routes to the ISP

Use BGP MD5 authentication with the ISP and apply a prefix-list to outbound advertisements

A company has a web server on an internal IP (192.168.1.10) that must be reachable from the internet on TCP 443. They have a single public IP (203.0.113.5). They also have an internal user who needs to access the web server using its public IP from inside the network. The firewall is stateful and performs NAT. What is the best configuration to support both inbound internet access and internal access via the public IP?

Create a firewall rule to allow internal users to access the server's private IP only

Use PAT for outbound traffic and rely on the stateful firewall to allow return traffic

Place the web server on the public IP directly without NAT

Configure static NAT for the web server and add a NAT hairpin rule for internal users

What is the primary purpose of enabling authentication for routing protocol updates, such as OSPF or BGP?

To prevent unauthorized routers from injecting false routing information

To compress routing updates for bandwidth efficiency

To increase the speed of route convergence

To encrypt the routing table contents

GIAC Defensible Security Architect

Domain 2Objective 2

Fundamental Layer 3 Defense GDSA Practice Questions (Page 6)

Part of the Network Security Fundamentals domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

Questions 26–30

26foundation · easy
What is the primary role of a Layer 3 tunnel in network security?
Select an answer first
27application · medium
A company needs to connect two branch offices over the internet. The connection must support multicast traffic and dynamic routing protocols between the sites. The security team requires that all traffic be encrypted. Which tunneling approach should be used?
Select an answer first
28expert · hard
A network team is migrating from OSPF to BGP for their enterprise core. They want to maintain security by preventing unauthorized route injection and ensuring that only valid internal prefixes are advertised to the upstream ISP. Which combination of BGP security features should they implement?
Select an answer first
29expert · hard
A company has a web server on an internal IP (192.168.1.10) that must be reachable from the internet on TCP 443. They have a single public IP (203.0.113.5). They also have an internal user who needs to access the web server using its public IP from inside the network. The firewall is stateful and performs NAT. What is the best configuration to support both inbound internet access and internal access via the public IP?
Select an answer first
30foundation · easy
What is the primary purpose of enabling authentication for routing protocol updates, such as OSPF or BGP?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.