What is the purpose of multi-factor authentication (MFA)?

To limit the number of failed login attempts

To verify a user's identity by requiring two or more independent credentials

To require users to change their passwords frequently

To encrypt all user communications

An organization wants to enforce least privilege for its employees. Currently, all employees have domain administrator rights. Which change best implements least privilege?

Keep all employees as domain administrators but require them to use a separate admin account.

Remove administrative rights from regular users and grant them only the permissions required for their job functions.

Grant all employees the same level of access to simplify management.

Disable all user accounts and require employees to share a single admin account.

What is the goal of patch management?

To create backups of critical data

To monitor network traffic for malicious activity

To replace all legacy software with new versions

To apply software updates that fix known vulnerabilities and improve functionality

A SOC is evaluating a new SIEM solution. The team has a limited budget and needs to reduce alert fatigue while ensuring that critical incidents are not missed. The current environment generates a high volume of low-fidelity alerts from multiple sources. Which approach is most effective?

Use a separate SIEM for each source to avoid mixing data.

Increase the threshold for all alerts to reduce the volume.

Implement correlation rules that combine multiple low-fidelity alerts into a single high-fidelity alert.

Disable alerts from sources that generate the most noise.

A security analyst notices repeated port scans from an external IP against the company's public-facing web server. The scans are not causing any damage, but the analyst wants to detect future reconnaissance and also block the source IP automatically. Which combination of controls best achieves both goals?

Configure the firewall to allow all traffic from the scanning IP to the web server.

Enable verbose logging on the web server and review logs weekly.

Deploy an intrusion prevention system (IPS) in inline mode with a rule to drop traffic from the scanning source.

Deploy an intrusion detection system (IDS) in passive mode and review alerts daily.

GIAC Information Security Fundamentals

Domain 3Objective 4

Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 2)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 6–10

6foundation · easy
What is the purpose of multi-factor authentication (MFA)?
Select an answer first
7application · medium
An organization wants to enforce least privilege for its employees. Currently, all employees have domain administrator rights. Which change best implements least privilege?
Select an answer first
8foundation · easy
What is the goal of patch management?
Select an answer first
9expert · hard
A SOC is evaluating a new SIEM solution. The team has a limited budget and needs to reduce alert fatigue while ensuring that critical incidents are not missed. The current environment generates a high volume of low-fidelity alerts from multiple sources. Which approach is most effective?
Select an answer first
10application · medium
A security analyst notices repeated port scans from an external IP against the company's public-facing web server. The scans are not causing any damage, but the analyst wants to detect future reconnaissance and also block the source IP automatically. Which combination of controls best achieves both goals?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.