A network administrator wants to detect and block malicious traffic that matches known attack signatures, but also wants to allow legitimate traffic that may be similar to an attack. Which device should the administrator deploy?

An intrusion detection system (IDS) configured in passive mode.

A firewall with stateful packet inspection.

A network tap connected to a packet analyzer.

An intrusion prevention system (IPS) configured in inline mode with signatures tuned to reduce false positives.

A small company has a flat network where all employees and the public-facing web server share the same subnet. After a breach, the security team wants to limit the blast radius and prevent direct access from the internet to internal workstations. Which two changes should the team implement together?

Place the web server in a DMZ and configure the firewall to allow only HTTP/HTTPS from the internet to the DMZ, with no inbound rules to the internal subnet.

Move the web server to a separate VLAN and enable VLAN trunking on the switch to allow inter-VLAN routing.

Configure the firewall to block all inbound traffic from the internet to the internal subnet, but leave the web server on the same subnet as employees.

Deploy an intrusion prevention system (IPS) inline before the firewall and enable signature updates.

A company is updating its network security policy. The security team wants to ensure that changes to firewall rules are reviewed and approved before implementation, and that there is a record of who made the change and why. Which policy element should the team include?

A change management procedure that requires a request, approval, implementation, and post-change review for all firewall rule changes.

A password policy that requires strong passwords for all network devices.

An acceptable use policy that defines what employees can do on the network.

An incident response plan that outlines steps to take during a security breach.

A company's internal DNS server is being used in a DNS amplification attack. The attacker sends spoofed queries to the DNS server, and the server responds to the victim with large responses. Which mitigation should the administrator implement to prevent the DNS server from being used in this way?

Configure the DNS server to only respond to queries from internal IP addresses and disable recursion for external queries.

Increase the DNS server's cache size.

Change the DNS server to use TCP instead of UDP.

Enable DNSSEC on the DNS server.

GIAC Information Security Fundamentals

Domain 2Objective 2

Network Security and Architecture GISF Practice Questions (Page 2)

Part of the Network and Systems Security domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 6–10

6application · medium
A network administrator wants to detect and block malicious traffic that matches known attack signatures, but also wants to allow legitimate traffic that may be similar to an attack. Which device should the administrator deploy?
Select an answer first
7foundation · easy
A security architect places multiple layers of controls, such as firewalls, intrusion detection, and encryption, so that if one control fails, another still provides protection. Which principle does this illustrate?
Select an answer first
8application · medium
A small company has a flat network where all employees and the public-facing web server share the same subnet. After a breach, the security team wants to limit the blast radius and prevent direct access from the internet to internal workstations. Which two changes should the team implement together?
Select an answer first
9application · medium
A company is updating its network security policy. The security team wants to ensure that changes to firewall rules are reviewed and approved before implementation, and that there is a record of who made the change and why. Which policy element should the team include?
Select an answer first
10application · medium
A company's internal DNS server is being used in a DNS amplification attack. The attacker sends spoofed queries to the DNS server, and the server responds to the victim with large responses. Which mitigation should the administrator implement to prevent the DNS server from being used in this way?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Network Security and Architecture GISF Practice Questions (Page 2)

Questions 6–10

A network administrator wants to detect and block malicious traffic that matches known attack signatures, but also wants to allow legitimate traffic that may be similar to an attack. Which device should the administrator deploy?

A security architect places multiple layers of controls, such as firewalls, intrusion detection, and encryption, so that if one control fails, another still provides protection. Which principle does this illustrate?

A company is updating its network security policy. The security team wants to ensure that changes to firewall rules are reviewed and approved before implementation, and that there is a record of who made the change and why. Which policy element should the team include?

A company's internal DNS server is being used in a DNS amplification attack. The attacker sends spoofed queries to the DNS server, and the server responds to the victim with large responses. Which mitigation should the administrator implement to prevent the DNS server from being used in this way?

Keep studying — Network and Systems Security