A security analyst notices that an internal server is sending a large volume of traffic to an external IP address on port 443 at unusual times. The traffic pattern is periodic and the server was not expected to initiate outbound connections. Which action should the analyst take first?

Block the external IP address at the firewall immediately.

Disable the server's network interface to stop the traffic.

Ignore the traffic because it is on port 443, which is commonly used for legitimate HTTPS.

Investigate the server's processes and network connections to determine if the traffic is malicious.

An organization wants to implement network access control (NAC) for all devices connecting to the corporate network. The requirement is that only devices that meet security policy (e.g., up-to-date antivirus, patched OS) are allowed on the network, and non-compliant devices should be placed on a quarantine VLAN. Which NAC approach best meets this requirement?

MAC address filtering on the switch

A firewall rule that blocks all traffic from unknown IP addresses

Port-based 802.1X authentication with post-admission posture assessment

A captive portal that requires users to accept an acceptable use policy

GIAC Information Security Fundamentals

Domain 2Objective 2

Network Security and Architecture GISF Practice Questions (Page 3)

Part of the Network and Systems Security domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 11–15

11application · medium
A security analyst notices that an internal server is sending a large volume of traffic to an external IP address on port 443 at unusual times. The traffic pattern is periodic and the server was not expected to initiate outbound connections. Which action should the analyst take first?
Select an answer first
12foundation · easy
In network security, which principle ensures that data has not been altered or tampered with during transmission?
Select an answer first
13foundation · easy
In the OSI model, which layer is responsible for routing packets across different networks?
Select an answer first
14foundation · easy
Which tool is commonly used to capture and analyze network traffic for troubleshooting and security monitoring?
Select an answer first
15application · medium
An organization wants to implement network access control (NAC) for all devices connecting to the corporate network. The requirement is that only devices that meet security policy (e.g., up-to-date antivirus, patched OS) are allowed on the network, and non-compliant devices should be placed on a quarantine VLAN. Which NAC approach best meets this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Network Security and Architecture GISF Practice Questions (Page 3)

Questions 11–15

A security analyst notices that an internal server is sending a large volume of traffic to an external IP address on port 443 at unusual times. The traffic pattern is periodic and the server was not expected to initiate outbound connections. Which action should the analyst take first?

In network security, which principle ensures that data has not been altered or tampered with during transmission?

In the OSI model, which layer is responsible for routing packets across different networks?

Which tool is commonly used to capture and analyze network traffic for troubleshooting and security monitoring?

Keep studying — Network and Systems Security