A company's laptops are used by employees who frequently travel and connect to public Wi-Fi. The security team wants to protect these devices from malware that may be delivered through malicious websites or email attachments. Which combination of controls provides the most comprehensive endpoint defense?

Enable the built-in Windows Defender and ensure it receives daily signature updates.

Require users to connect through a VPN at all times.

Disable JavaScript in the browser to prevent drive-by downloads.

Deploy an endpoint protection platform (EPP) that includes antivirus, behavioral analysis, and web filtering.

What is the primary function of network segmentation in a defensive architecture?

To allow all devices to communicate freely while monitoring traffic for anomalies

To isolate different parts of the network so that a compromise in one segment does not easily spread to others

To replace the need for firewalls by using VLANs

To increase network speed by reducing the number of devices on each segment

A company is designing a network for a new office. They want to segment the network to protect sensitive research data from general employee devices. The research team needs to access the internet and the corporate email system, but general employees should not access the research network. Which network design best meets these requirements?

Use a single flat network and restrict access to the research data through application permissions.

Place all devices on the same VLAN and rely on host-based firewalls on research devices.

Create a separate VLAN for the research team with a firewall rule that allows only the research VLAN to reach the internet and the email server, and blocks all other traffic to the research VLAN.

Connect the research team to a separate internet connection and do not connect them to the corporate network.

A healthcare organization stores patient records in a database and transmits them to a partner over the internet. The organization must protect the data both at rest and in transit. Which combination of controls best achieves this?

Apply database column-level encryption but transmit the data in plaintext over the internet.

Encrypt the database files with AES-256 and use TLS 1.2 or higher for the network transmission.

Use only a VPN for the partner connection and leave the database unencrypted.

Rely on the partner's firewall to protect the data during transmission.

A security analyst is configuring a network defense for a small business. The business wants to detect and block malicious traffic in real time, but also wants to retain the ability to analyze historical traffic patterns. Which combination of technologies best meets these needs?

An intrusion prevention system (IPS) inline and a SIEM that collects logs from the IPS.

A web application firewall (WAF) and a log management system.

An intrusion detection system (IDS) in passive mode and a packet capture tool.

A firewall with logging enabled and a network tap.

GIAC Information Security Fundamentals

Domain 3Objective 4

Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 8)

Part of the Threats and Defenses domain, which makes up ~36% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–29 in this domain), expect 5–7 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

11concepts

Questions 36–40

36application · medium
A company's laptops are used by employees who frequently travel and connect to public Wi-Fi. The security team wants to protect these devices from malware that may be delivered through malicious websites or email attachments. Which combination of controls provides the most comprehensive endpoint defense?
Select an answer first
37foundation · easy
What is the primary function of network segmentation in a defensive architecture?
Select an answer first
38expert · hard
A company is designing a network for a new office. They want to segment the network to protect sensitive research data from general employee devices. The research team needs to access the internet and the corporate email system, but general employees should not access the research network. Which network design best meets these requirements?
Select an answer first
39application · medium
A healthcare organization stores patient records in a database and transmits them to a partner over the internet. The organization must protect the data both at rest and in transit. Which combination of controls best achieves this?
Select an answer first
40application · medium
A security analyst is configuring a network defense for a small business. The business wants to detect and block malicious traffic in real time, but also wants to retain the ability to analyze historical traffic patterns. Which combination of technologies best meets these needs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 8)

Questions 36–40

What is the primary function of network segmentation in a defensive architecture?

A healthcare organization stores patient records in a database and transmits them to a partner over the internet. The organization must protect the data both at rest and in transit. Which combination of controls best achieves this?

A security analyst is configuring a network defense for a small business. The business wants to detect and block malicious traffic in real time, but also wants to retain the ability to analyze historical traffic patterns. Which combination of technologies best meets these needs?

Keep studying — Threats and Defenses