What type of data is typically collected for endpoint visibility?

Process execution and network connections

Which of the following is an example of an automated response to a compromised endpoint?

Isolating the endpoint from the network

Sending an email to the user asking them to run a scan

Waiting for the user to report the issue

What is the purpose of automated remediation for non-compliant endpoints?

To immediately disconnect the endpoint from the network

To restore the endpoint to a compliant state without manual intervention

To permanently delete all data on the endpoint

To notify the user to restart their computer

A hospital's IT team wants to segment its network so that an infected infusion pump cannot reach the electronic health record (EHR) system or other medical devices. The pumps are on a separate VLAN, but the team is concerned about lateral movement within the VLAN. Which control should be added?

Configure the switch ports to use MAC address filtering to allow only known pump MAC addresses.

Use a single firewall rule that blocks all traffic from the pump VLAN to the EHR VLAN.

Enable micro-segmentation on the switch to restrict each infusion pump to communicate only with its management server and block all other traffic.

Place the infusion pumps on the same subnet as the EHR system to simplify management.

A security operations center (SOC) is implementing a zero trust endpoint monitoring strategy. They want to ensure they have visibility into endpoint activities and can detect anomalies. Which of the following are essential components of this strategy? (Select all that apply.)

Implementing user and entity behavior analytics (UEBA) to establish baselines and detect anomalous behavior.

Deploying an EDR agent on all managed endpoints to collect process, file, and network activity telemetry.

Configuring the EDR to automatically quarantine any endpoint that generates an alert.

Integrating endpoint telemetry with a SIEM for centralized analysis and correlation with other security data.

Relying solely on network firewall logs to monitor endpoint activity.

GIAC Defensible Security Architect

Domain 1Objective 2

Zero Trust Endpoints GDSA Practice Questions (Page 1)

Part of the Zero Trust Architecture domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 4–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 1–5

1foundation · easy
What type of data is typically collected for endpoint visibility?
Select an answer first
2foundation · easy
Which of the following is an example of an automated response to a compromised endpoint?
Select an answer first
3foundation · easy
What is the purpose of automated remediation for non-compliant endpoints?
Select an answer first
4application · medium
A hospital's IT team wants to segment its network so that an infected infusion pump cannot reach the electronic health record (EHR) system or other medical devices. The pumps are on a separate VLAN, but the team is concerned about lateral movement within the VLAN. Which control should be added?
Select an answer first
5expert · hard · select all that apply
A security operations center (SOC) is implementing a zero trust endpoint monitoring strategy. They want to ensure they have visibility into endpoint activities and can detect anomalies. Which of the following are essential components of this strategy? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GDSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GDSA” is a trademark of its owner, used for identification only.