A company is migrating its web application from HTTP to HTTPS. The security team wants to ensure that all traffic is encrypted and that users cannot accidentally access the site over HTTP. However, some legacy clients do not support TLS 1.2 and will fail to connect if the server disables older protocols. Which approach best balances security and compatibility?

Use TLS 1.0 for all clients to maximize compatibility.

Disable all TLS versions and use only SSL 3.0 for legacy clients.

Enable TLS 1.2 and TLS 1.3 on the server, redirect HTTP to HTTPS, and use HSTS with a short max-age.

Keep HTTP enabled and only encrypt the login page.

A security analyst is investigating a suspected ARP spoofing attack on a local network segment. The analyst notices that the ARP cache of a workstation shows an incorrect MAC address for the default gateway. Which immediate action should the analyst take to confirm the attack?

Reboot the workstation to clear the ARP cache.

Capture and analyze ARP traffic on the segment to see if multiple devices are claiming the gateway's IP address.

Change the workstation's IP address to avoid the attack.

Disable the workstation's network interface.

A company is deploying a new internal application that must be accessible only to employees on the corporate network. The security team wants to prevent unauthorized access and also detect any malicious activity. Which combination of network devices should be deployed?

A router with access control lists (ACLs) and a switch with port security.

An intrusion prevention system (IPS) only, with no firewall.

A firewall to restrict access to the application and an intrusion detection system (IDS) to monitor traffic for suspicious activity.

A load balancer and a web application firewall (WAF).

A security analyst is reviewing network traffic logs and notices a large number of TCP SYN packets sent to a single server from many different source IP addresses, but no corresponding SYN-ACK responses. The server is becoming unresponsive. Which type of attack is this, and what immediate mitigation should be applied?

This is a spoofing attack; enable MAC address filtering on the switch.

This is a ping flood; block ICMP traffic at the firewall.

This is a DNS amplification attack; restrict DNS recursion.

This is a SYN flood; enable SYN cookies on the server or configure the firewall to rate-limit incoming SYN packets.

GIAC Information Security Fundamentals

Domain 2Objective 2

Network Security and Architecture GISF Practice Questions (Page 6)

Part of the Network and Systems Security domain, which makes up ~28% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~14–22 in this domain), expect 5–7 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 26–30

26expert · hard
A company is migrating its web application from HTTP to HTTPS. The security team wants to ensure that all traffic is encrypted and that users cannot accidentally access the site over HTTP. However, some legacy clients do not support TLS 1.2 and will fail to connect if the server disables older protocols. Which approach best balances security and compatibility?
Select an answer first
27foundation · easy
Which process ensures that changes to network devices are reviewed, tested, and approved before implementation?
Select an answer first
28expert · hard
A security analyst is investigating a suspected ARP spoofing attack on a local network segment. The analyst notices that the ARP cache of a workstation shows an incorrect MAC address for the default gateway. Which immediate action should the analyst take to confirm the attack?
Select an answer first
29expert · hard
A company is deploying a new internal application that must be accessible only to employees on the corporate network. The security team wants to prevent unauthorized access and also detect any malicious activity. Which combination of network devices should be deployed?
Select an answer first
30application · medium
A security analyst is reviewing network traffic logs and notices a large number of TCP SYN packets sent to a single server from many different source IP addresses, but no corresponding SYN-ACK responses. The server is becoming unresponsive. Which type of attack is this, and what immediate mitigation should be applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISF” is a trademark of its owner, used for identification only.

Network Security and Architecture GISF Practice Questions (Page 6)

Questions 26–30

Which process ensures that changes to network devices are reviewed, tested, and approved before implementation?

A security analyst is investigating a suspected ARP spoofing attack on a local network segment. The analyst notices that the ARP cache of a workstation shows an incorrect MAC address for the default gateway. Which immediate action should the analyst take to confirm the attack?

A company is deploying a new internal application that must be accessible only to employees on the corporate network. The security team wants to prevent unauthorized access and also detect any malicious activity. Which combination of network devices should be deployed?

Keep studying — Network and Systems Security