A multi-tenant office building has a shared network infrastructure. Each tenant must not be able to communicate directly with other tenants at Layer 2, but all tenants need access to the internet and a shared printer. The network team wants to enforce isolation without deploying separate physical switches for each tenant. Which approach best meets these requirements?

Use private VLANs with community ports for all tenants.

Place all tenants in the same VLAN and use MAC address filtering on the switch.

Create a separate VLAN for each tenant and route between them at Layer 3.

Disable unused ports and enable port security on all switch ports.

A hospital network recently experienced an outage where the switch's CAM table filled with thousands of fake MAC addresses, causing the switch to flood traffic out all ports. An analyst captured ARP traffic and noticed many unsolicited ARP replies claiming to be the default gateway. Which two controls should be implemented to prevent both the CAM table exhaustion and the ARP spoofing?

Enable DHCP snooping and configure all ports as trunk ports.

Enable BPDU guard on all access ports and configure root guard on uplinks.

Disable unused ports and enable loop guard on all switch ports.

Enable port security to limit MAC addresses per port and enable Dynamic ARP Inspection.

A company's IT team suspects that an attacker on the internal network is sending forged DHCP offers to redirect clients to a rogue gateway. They also want to prevent an attacker from sending gratuitous ARP messages to poison the ARP cache of clients. Which two features should be enabled on the access switches?

DHCP snooping and Dynamic ARP Inspection

VLAN segmentation and private VLANs

GIAC Defensible Security Architect

Domain 2Objective 3

Layer 1/Layer 2 Defense GDSA Practice Questions (Page 5)

Part of the Network Security Fundamentals domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

Questions 21–25

21foundation · easy
Which Layer 2 attack involves an attacker sending forged ARP messages to associate their MAC address with the IP address of a legitimate host?
Select an answer first
22application · medium
A multi-tenant office building has a shared network infrastructure. Each tenant must not be able to communicate directly with other tenants at Layer 2, but all tenants need access to the internet and a shared printer. The network team wants to enforce isolation without deploying separate physical switches for each tenant. Which approach best meets these requirements?
Select an answer first
23application · medium
A hospital network recently experienced an outage where the switch's CAM table filled with thousands of fake MAC addresses, causing the switch to flood traffic out all ports. An analyst captured ARP traffic and noticed many unsolicited ARP replies claiming to be the default gateway. Which two controls should be implemented to prevent both the CAM table exhaustion and the ARP spoofing?
Select an answer first
24application · medium
A company's IT team suspects that an attacker on the internal network is sending forged DHCP offers to redirect clients to a rogue gateway. They also want to prevent an attacker from sending gratuitous ARP messages to poison the ARP cache of clients. Which two features should be enabled on the access switches?
Select an answer first
25foundation · easy
Which physical security control is specifically designed to prevent an attacker from removing a laptop from a desk or workstation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.

Layer 1/Layer 2 Defense GDSA Practice Questions (Page 5)

Questions 21–25

Which Layer 2 attack involves an attacker sending forged ARP messages to associate their MAC address with the IP address of a legitimate host?

Which physical security control is specifically designed to prevent an attacker from removing a laptop from a desk or workstation?

Keep studying — Network Security Fundamentals