A company is migrating to IPv6 but must maintain connectivity with legacy IPv4-only servers for the next two years. The security team is concerned about the risk of tunneling protocols bypassing the firewall. Which transition strategy should the company adopt to minimize security risk while ensuring compatibility?

Deploy NAT64 translation to convert IPv6 traffic to IPv4 at the edge.

Use 6to4 tunneling to encapsulate IPv6 in IPv4 packets across the network.

Configure ISATAP tunnels on all internal hosts to reach IPv4 servers.

Implement dual-stack on all devices and firewalls, allowing native IPv6 and IPv4 traffic.

A network administrator is troubleshooting an IPv6 connectivity issue. A host has a global IPv6 address but cannot communicate with a server on the same subnet. The administrator captures traffic and sees Neighbor Solicitation messages being sent, but no Neighbor Advertisement is received. What is the most likely cause?

The host's link-local address is not configured correctly.

The target server is not responding to Neighbor Solicitations because it is offline or has a firewall blocking ICMPv6.

The host is using the wrong subnet prefix for the server's address.

The router is not configured to forward Neighbor Solicitations.

A security analyst is assessing the risk of IPv6 transition mechanisms in the corporate network. The network currently uses dual-stack, but some remote sites use 6to4 tunneling. Which security concern is most directly associated with 6to4 tunneling?

6to4 tunnels require a public IPv4 address on every host.

6to4 tunnels are not supported by modern operating systems.

Attackers can inject IPv6 packets into the tunnel by spoofing the IPv4 source address.

6to4 tunnels automatically encrypt all IPv6 traffic.

GIAC Defensible Security Architect

Domain 3Objective 3

IPv6 GDSA Practice Questions (Page 2)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 6–10

6application · medium
A company is migrating to IPv6 but must maintain connectivity with legacy IPv4-only servers for the next two years. The security team is concerned about the risk of tunneling protocols bypassing the firewall. Which transition strategy should the company adopt to minimize security risk while ensuring compatibility?
Select an answer first
7expert · hard
A network administrator is troubleshooting an IPv6 connectivity issue. A host has a global IPv6 address but cannot communicate with a server on the same subnet. The administrator captures traffic and sees Neighbor Solicitation messages being sent, but no Neighbor Advertisement is received. What is the most likely cause?
Select an answer first
8application · medium
A security analyst is assessing the risk of IPv6 transition mechanisms in the corporate network. The network currently uses dual-stack, but some remote sites use 6to4 tunneling. Which security concern is most directly associated with 6to4 tunneling?
Select an answer first
9foundation · easy
Which IPv6 feature can be exploited by attackers to bypass security devices that only inspect the base IPv6 header?
Select an answer first
10foundation · easy
Which routing protocol is commonly used in IPv6 networks and is the successor to RIPng?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

IPv6 GDSA Practice Questions (Page 2)

Questions 6–10

A security analyst is assessing the risk of IPv6 transition mechanisms in the corporate network. The network currently uses dual-stack, but some remote sites use 6to4 tunneling. Which security concern is most directly associated with 6to4 tunneling?

Which IPv6 feature can be exploited by attackers to bypass security devices that only inspect the base IPv6 header?

Which routing protocol is commonly used in IPv6 networks and is the successor to RIPng?

Keep studying — Network Services and Encryption