A security analyst is reviewing IPv6 packet captures and sees the address 2001:db8::1. The analyst needs to determine the scope of this address. Which statement is correct?

It is a multicast address because it contains the 'db8' segment.

It is a global unicast address because it starts with 2001::/16.

It is a unique local address because it is not routable on the internet.

It is a link-local address because it uses the :: notation.

A security analyst is reviewing firewall rules for IPv6. The analyst wants to allow inbound SSH to a server from the internet, but only from a specific remote office that has a dynamic IPv6 prefix. The remote office obtains its prefix via DHCPv6-PD from its ISP. Which approach is the most secure and practical?

Use a static IPv6 address for the remote office's firewall.

Allow SSH from the entire IPv6 prefix assigned to the remote office.

Allow SSH from any IPv6 address because the server has a firewall.

Use IPv6 extension headers to authenticate the source.

A security architect is designing IPv6 address assignment for a high-security environment. The requirement is that all client addresses must be unpredictable to prevent scanning and tracking, but the network must also support forensic logging of which client used a particular address at a given time. Which combination of configuration methods best meets these requirements?

Use SLAAC with EUI-64 and log the MAC address.

Use DHCPv6 with stateful assignment and log the DUID and leased address.

Use static addresses and log the MAC address in the switch.

Use SLAAC with privacy extensions and log the DUID from DHCPv6.

A network administrator is deploying IPv6 in a multi-tenant environment. Each tenant has its own VLAN and requires IPv6 connectivity. The administrator wants to prevent tenants from performing neighbor discovery attacks against each other. Which configuration is the most effective?

Disable IPv6 on all tenant VLANs.

Use a unique /64 prefix for each tenant VLAN.

Enable IPv6 first-hop security features such as RA Guard and ND snooping on the switches.

Use DHCPv6 snooping on the switches.

A company is deploying IPv6 and wants to ensure that all client devices receive addresses that are centrally managed and can be tracked for security audits. However, the company also wants to support devices that do not support DHCPv6. Which strategy should be used to meet both requirements?

Use only SLAAC for all devices and rely on DNS to track devices.

Use stateful DHCPv6 for devices that support it and SLAAC for devices that do not, while using Router Advertisements to provide DNS information.

Use static IPv6 addresses for all devices to ensure tracking.

Use only stateful DHCPv6 and require all devices to support it.

GIAC Defensible Security Architect

Domain 3Objective 3

IPv6 GDSA Practice Questions (Page 1)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 1–5

1application · medium
A security analyst is reviewing IPv6 packet captures and sees the address 2001:db8::1. The analyst needs to determine the scope of this address. Which statement is correct?
Select an answer first
2expert · hard
A security analyst is reviewing firewall rules for IPv6. The analyst wants to allow inbound SSH to a server from the internet, but only from a specific remote office that has a dynamic IPv6 prefix. The remote office obtains its prefix via DHCPv6-PD from its ISP. Which approach is the most secure and practical?
Select an answer first
3expert · hard
A security architect is designing IPv6 address assignment for a high-security environment. The requirement is that all client addresses must be unpredictable to prevent scanning and tracking, but the network must also support forensic logging of which client used a particular address at a given time. Which combination of configuration methods best meets these requirements?
Select an answer first
4expert · hard
A network administrator is deploying IPv6 in a multi-tenant environment. Each tenant has its own VLAN and requires IPv6 connectivity. The administrator wants to prevent tenants from performing neighbor discovery attacks against each other. Which configuration is the most effective?
Select an answer first
5expert · hard
A company is deploying IPv6 and wants to ensure that all client devices receive addresses that are centrally managed and can be tracked for security audits. However, the company also wants to support devices that do not support DHCPv6. Which strategy should be used to meet both requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.