A security team is considering using a new threat intelligence feed that provides indicators of compromise (IOCs) for a recently discovered malware campaign. The feed has a high false-positive rate, and the team is concerned about alert fatigue. The team wants to use the feed to improve defenses without overwhelming the SOC. Which approach is most appropriate?

Use the feed to enrich existing alerts rather than generate new alerts.

Block all IOCs at the firewall immediately.

Ignore the feed because of the high false-positive rate.

Integrate the feed into the SIEM and create alerts for all IOCs, but with a low priority.

What is the core idea of defense-in-depth?

Using the strongest possible encryption for all data

Focusing all security efforts on the network perimeter

Using multiple layers of security controls so that if one fails, others still provide protection

Deploying a single, comprehensive security solution

A firewall is configured to allow inbound traffic only on port 443 (HTTPS) to a web server. What is the firewall doing?

It is encrypting all traffic to the web server

It is blocking all traffic except HTTPS, thereby controlling traffic flow based on rules

It is logging all user activity on the web server

It is detecting and preventing malware in the HTTPS traffic

What is the primary function of a Security Information and Event Management (SIEM) system?

To encrypt data stored in databases

To aggregate and analyze log data from multiple sources to detect security incidents

To manage user identities and access rights

To block malicious traffic at the network perimeter

A small company runs a web application on a single server that also hosts a database. The server sits in a DMZ. The security team wants to limit the blast radius if the web application is compromised, while keeping the application functional. Which action best meets this goal?

Place the web server and database on the same VLAN to reduce latency.

Install antivirus software on the web server and enable real-time scanning.

Move the database to a separate internal network segment and allow only the web server to reach it on the database port.

Configure the firewall to allow all traffic from the internet to the web server's IP address.

GIAC Information Security Fundamentals

Domain 3Objective 4

Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 1)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 1–5

1expert · hard
A security team is considering using a new threat intelligence feed that provides indicators of compromise (IOCs) for a recently discovered malware campaign. The feed has a high false-positive rate, and the team is concerned about alert fatigue. The team wants to use the feed to improve defenses without overwhelming the SOC. Which approach is most appropriate?
Select an answer first
2foundation · easy
What is the core idea of defense-in-depth?
Select an answer first
3foundation · easy
A firewall is configured to allow inbound traffic only on port 443 (HTTPS) to a web server. What is the firewall doing?
Select an answer first
4foundation · easy
What is the primary function of a Security Information and Event Management (SIEM) system?
Select an answer first
5application · medium
A small company runs a web application on a single server that also hosts a database. The server sits in a DMZ. The security team wants to limit the blast radius if the web application is compromised, while keeping the application functional. Which action best meets this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.