A network administrator is investigating a security incident where an attacker connected a laptop to an unused wall jack and successfully intercepted traffic between two other hosts on the same VLAN. The switch logs show that the attacker's MAC address was learned on the port. Which Layer 2 attack did the attacker most likely perform, and which control would have prevented it?

VLAN hopping; disable DTP on the port.

ARP spoofing; enable Dynamic ARP Inspection on the VLAN.

MAC flooding; enable port security on the port.

DHCP starvation; enable DHCP snooping.

What is the primary purpose of VLAN segmentation at Layer 2?

To increase the speed of the network

To isolate broadcast domains and enforce security boundaries

To encrypt traffic between hosts

To provide redundancy for network links

A network administrator notices that a switch in the server room has become the root bridge for the spanning tree, even though the core switch should be the root. The administrator suspects a user connected a rogue switch to an access port in a conference room. Which configuration change on the access ports would prevent this type of topology manipulation?

Enable BPDU guard on all access ports.

Enable root guard on all access ports.

Set the spanning-tree priority to 0 on the core switch.

Enable loop guard on all access ports.

GIAC Defensible Security Architect

Domain 2Objective 3

Layer 1/Layer 2 Defense GDSA Practice Questions (Page 4)

Part of the Network Security Fundamentals domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 16–20

16application · medium
A network administrator is investigating a security incident where an attacker connected a laptop to an unused wall jack and successfully intercepted traffic between two other hosts on the same VLAN. The switch logs show that the attacker's MAC address was learned on the port. Which Layer 2 attack did the attacker most likely perform, and which control would have prevented it?
Select an answer first
17foundation · easy
Which security feature uses the DHCP snooping binding table to validate ARP packets and prevent ARP spoofing?
Select an answer first
18foundation · easy
What is the primary purpose of VLAN segmentation at Layer 2?
Select an answer first
19foundation · easy
Which Layer 2 security measure restricts the number of MAC addresses that can be learned on a switch port?
Select an answer first
20application · medium
A network administrator notices that a switch in the server room has become the root bridge for the spanning tree, even though the core switch should be the root. The administrator suspects a user connected a rogue switch to an access port in a conference room. Which configuration change on the access ports would prevent this type of topology manipulation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Layer 1/Layer 2 Defense GDSA Practice Questions (Page 4)

Questions 16–20

Which security feature uses the DHCP snooping binding table to validate ARP packets and prevent ARP spoofing?

What is the primary purpose of VLAN segmentation at Layer 2?

Which Layer 2 security measure restricts the number of MAC addresses that can be learned on a switch port?

Keep studying — Network Security Fundamentals