A network architect is designing an IPv6 network for a financial institution. The institution requires that all internal DNS queries be authenticated to prevent DNS spoofing. The network uses Active Directory DNS servers. Which technology should be implemented?

Split-horizon DNS with separate internal and external zones.

DNS over HTTPS (DoH) on the internal DNS servers.

DNSSEC on the internal DNS servers.

An organization is deploying IPv6 and wants to ensure that internal hosts can resolve names and that multicast traffic for service discovery is contained within the local subnet. The security team also wants to prevent unauthorized hosts from joining the multicast group. Which combination of controls should be implemented?

Configure DNS A records and use IGMP snooping on switches.

Configure DNS AAAA records and use MLD snooping with port security on switches.

Configure static host entries and disable multicast on all switches.

Configure DHCPv6 for name resolution and use multicast routing across the enterprise.

A network administrator is configuring IPv6 on a network that uses OSPFv3 for routing. The administrator wants to ensure that routing updates are authenticated and that only authorized routers can participate. Which configuration should be used?

Use OSPFv3 with simple password authentication.

Use static routes instead of OSPFv3 to avoid authentication issues.

Use OSPFv3 with IPsec authentication on all routing adjacencies.

Use OSPFv2 with MD5 authentication.

An organization is migrating to IPv6 but must maintain access to legacy IPv4-only servers for the next two years. The network team wants to minimize security exposure and avoid introducing new single points of failure. Which transition approach best meets these requirements?

Configure ISATAP tunneling on the internal network for IPv6 connectivity.

Deploy dual-stack on all routers and hosts, enabling both IPv4 and IPv6 simultaneously.

Use 6to4 tunneling to encapsulate IPv6 packets in IPv4 headers across the network.

Implement NAT64 translation to allow IPv6-only clients to reach IPv4 servers.

GIAC Defensible Security Architect

Domain 3Objective 3

IPv6 GDSA Practice Questions (Page 8)

Part of the Network Services and Encryption domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 4–6 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 36–40

36expert · hard
A network architect is designing an IPv6 network for a financial institution. The institution requires that all internal DNS queries be authenticated to prevent DNS spoofing. The network uses Active Directory DNS servers. Which technology should be implemented?
Select an answer first
37application · medium
An organization is deploying IPv6 and wants to ensure that internal hosts can resolve names and that multicast traffic for service discovery is contained within the local subnet. The security team also wants to prevent unauthorized hosts from joining the multicast group. Which combination of controls should be implemented?
Select an answer first
38foundation · easy
Which IPv6 address configuration method allows a host to automatically obtain its address from router advertisements without any stateful server?
Select an answer first
39expert · hard
A network administrator is configuring IPv6 on a network that uses OSPFv3 for routing. The administrator wants to ensure that routing updates are authenticated and that only authorized routers can participate. Which configuration should be used?
Select an answer first
40application · medium
An organization is migrating to IPv6 but must maintain access to legacy IPv4-only servers for the next two years. The network team wants to minimize security exposure and avoid introducing new single points of failure. Which transition approach best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

IPv6 GDSA Practice Questions (Page 8)

Questions 36–40

A network architect is designing an IPv6 network for a financial institution. The institution requires that all internal DNS queries be authenticated to prevent DNS spoofing. The network uses Active Directory DNS servers. Which technology should be implemented?

Which IPv6 address configuration method allows a host to automatically obtain its address from router advertisements without any stateful server?

A network administrator is configuring IPv6 on a network that uses OSPFv3 for routing. The administrator wants to ensure that routing updates are authenticated and that only authorized routers can participate. Which configuration should be used?

An organization is migrating to IPv6 but must maintain access to legacy IPv4-only servers for the next two years. The network team wants to minimize security exposure and avoid introducing new single points of failure. Which transition approach best meets these requirements?

Keep studying — Network Services and Encryption