What is the primary purpose of Network Access Control (NAC)?

To monitor network traffic for malicious activity after access is granted

To enforce security policies on devices before they are granted network access

To encrypt all traffic between network devices

To provide secure remote access for teleworkers

Where are firewalls typically deployed in a network architecture?

Only in the DMZ, because internal networks do not need filtering

At network boundaries and between internal segments to enforce security policies

Only on individual hosts, because network-level firewalls are obsolete

Only at the internet perimeter, because internal traffic is always trusted

A hospital wants to ensure that only compliant, managed devices can connect to its internal network. They have a mix of hospital-owned laptops and personal devices used by visiting specialists. The network team needs to enforce a policy that allows hospital-owned devices full access, but restricts personal devices to a separate guest VLAN with internet-only access. Which technology should they deploy?

A stateful firewall with rules that allow only hospital-owned MAC addresses to access the internal network.

Network Access Control (NAC) that checks device compliance and assigns the appropriate VLAN based on device posture and ownership.

A VPN that requires all devices to authenticate before accessing any network resources.

An intrusion prevention system (IPS) that blocks traffic from devices that do not have the latest antivirus signatures.

What does the 'default deny' principle mean in secure network architecture?

Only traffic from untrusted networks is denied

Traffic is denied only when an intrusion is detected

All traffic is denied unless a specific rule allows it

All traffic is allowed unless a specific rule denies it

In secure network architecture, what does the principle of least privilege require?

That network access is denied by default and only granted after a security review

That administrators have unlimited access to all network resources

That all users have the same level of access to simplify administration

That users and devices are granted only the minimum access necessary to perform their functions

GIAC Defensible Security Architect

Domain 2Objective 4

Network Defenses GDSA Practice Questions (Page 4)

Part of the Network Security Fundamentals domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 16–20

16foundation · easy
What is the primary purpose of Network Access Control (NAC)?
Select an answer first
17foundation · easy
Where are firewalls typically deployed in a network architecture?
Select an answer first
18application · medium
A hospital wants to ensure that only compliant, managed devices can connect to its internal network. They have a mix of hospital-owned laptops and personal devices used by visiting specialists. The network team needs to enforce a policy that allows hospital-owned devices full access, but restricts personal devices to a separate guest VLAN with internet-only access. Which technology should they deploy?
Select an answer first
19foundation · easy
What does the 'default deny' principle mean in secure network architecture?
Select an answer first
20foundation · easy
In secure network architecture, what does the principle of least privilege require?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.