A company is designing a network for a new office. The office has three departments: finance, engineering, and guest Wi-Fi. The finance department handles sensitive data and must be isolated from the other departments. The engineering department needs to collaborate with finance on some projects. The guest Wi-Fi must have internet access only. Which network design best meets these requirements while maintaining a strong security posture?

Place all departments on a single VLAN and use host-based firewalls to protect finance systems.

Create three VLANs, but allow guest Wi-Fi to access the internet and the engineering VLAN for convenience.

Create three VLANs: finance, engineering, and guest. Use a firewall to allow only necessary traffic between finance and engineering, and block all traffic from guest to the other VLANs.

Create two VLANs: one for finance and engineering together, and one for guest Wi-Fi.

A security architect is threat modeling a new web application. The application allows users to upload files that are stored on a backend server. The architect is identifying potential threats using a structured approach. Which threat modeling technique would most directly help identify the risk of an attacker uploading a malicious file that executes on the server?

Reviewing the server's patch management policy.

Conducting a penetration test on the application.

Creating a data flow diagram to trace the path of user-uploaded files from the web tier to the storage tier.

Reviewing the organization's incident response plan.

What is the primary purpose of a security zone in network architecture?

To segment the network into areas with similar security requirements to control traffic flow and contain threats

To eliminate the need for firewalls by isolating all systems

To increase the speed of network traffic by reducing latency

To provide a backup location for critical servers

In a defense-in-depth architecture, which combination of controls best illustrates the layered approach?

A single next-generation firewall with advanced threat protection features

A firewall, an intrusion prevention system, and a host-based endpoint detection agent

A virtual private network (VPN) and a secure socket layer (SSL) inspection proxy

Two identical firewalls deployed in parallel for redundancy

GIAC Defensible Security Architect

Domain 2Objective 1

Fundamental Security Architecture Concepts GDSA Practice Questions (Page 7)

Part of the Network Security Fundamentals domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

Questions 31–35

31expert · hard
A company is designing a network for a new office. The office has three departments: finance, engineering, and guest Wi-Fi. The finance department handles sensitive data and must be isolated from the other departments. The engineering department needs to collaborate with finance on some projects. The guest Wi-Fi must have internet access only. Which network design best meets these requirements while maintaining a strong security posture?
Select an answer first
32application · medium
A security architect is threat modeling a new web application. The application allows users to upload files that are stored on a backend server. The architect is identifying potential threats using a structured approach. Which threat modeling technique would most directly help identify the risk of an attacker uploading a malicious file that executes on the server?
Select an answer first
33application · medium
A financial institution is deploying a new application that processes sensitive customer data. The architecture team is defining access controls for the application's administrative functions. The compliance team requires that no single individual can both approve and execute a fund transfer. Which security architecture principle directly addresses this requirement?
Select an answer first
34foundation · easy
What is the primary purpose of a security zone in network architecture?
Select an answer first
35foundation · easy
In a defense-in-depth architecture, which combination of controls best illustrates the layered approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Fundamental Security Architecture Concepts GDSA Practice Questions (Page 7)

Questions 31–35

What is the primary purpose of a security zone in network architecture?

In a defense-in-depth architecture, which combination of controls best illustrates the layered approach?

Keep studying — Network Security Fundamentals