Why is network monitoring important for security incident detection?

It provides visibility into network traffic to identify suspicious activity and potential breaches

It automatically patches vulnerabilities in network devices

It replaces the need for firewalls and other security controls

It prevents all attacks from reaching the network

After a security incident, the incident response team needs to determine how an attacker moved laterally from a compromised workstation to a database server. The network team had not enabled any traffic logging. Which action would have most helped the investigation?

Deploy an IDS with signatures for known database attacks.

Enable NetFlow or similar flow logging on core switches and firewalls to capture metadata about connections between hosts.

Implement network segmentation to isolate the database server from the workstation subnet.

Configure syslog forwarding from all servers to a central log server.

Which action might a NAC system take when a device fails a security policy check?

It encrypts the device's traffic to protect the network from infection

It places the device in a quarantine network with limited access until the issue is resolved

It immediately blocks all traffic from the device permanently

It grants full network access but logs the violation for later review

A security team wants to monitor network traffic for signs of an attack and receive alerts when suspicious activity is detected. They do not want the system to automatically block traffic. Which control should they deploy?

Use a network access control (NAC) solution to block devices that generate suspicious traffic.

Deploy an intrusion detection system (IDS) that generates alerts on suspicious activity.

Deploy an intrusion prevention system (IPS) that automatically drops malicious traffic.

Configure a firewall to log all traffic and send alerts for any traffic that matches a deny rule.

GIAC Defensible Security Architect

Domain 2Objective 4

Network Defenses GDSA Practice Questions (Page 9)

Part of the Network Security Fundamentals domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 41–44

41foundation · easy
Why is network monitoring important for security incident detection?
Select an answer first
42application · medium
After a security incident, the incident response team needs to determine how an attacker moved laterally from a compromised workstation to a database server. The network team had not enabled any traffic logging. Which action would have most helped the investigation?
Select an answer first
43foundation · easy
Which action might a NAC system take when a device fails a security policy check?
Select an answer first
44application · medium
A security team wants to monitor network traffic for signs of an attack and receive alerts when suspicious activity is detected. They do not want the system to automatically block traffic. Which control should they deploy?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.