A company is deploying a new web application that will be accessed by customers over the internet. The application server must be reachable from the public internet, but the database server must only be reachable from the application server. The security team wants to minimize the attack surface. Which network design best meets these requirements?

Place both servers in the DMZ and allow the database to accept connections from any source

Use a single VLAN for all servers and configure port security on the switch

Place the web server in a DMZ and the database server in a separate internal subnet with a firewall rule allowing only the web server's IP to access the database port

Place both servers on the same internal subnet and rely on the host firewall on the database server

A company needs to connect its headquarters to a branch office over the internet. The traffic will carry sensitive financial data, and the security team requires encryption and integrity protection for all traffic between the two sites. Which solution should be selected?

SSH tunnel established between two Linux servers at each site

Remote access VPN using TLS for individual users

SSL/TLS termination on the branch office's web proxy

Site-to-site IPsec VPN tunnel between the two site gateways

What is the primary goal of Network Access Control (NAC)?

To provide secure remote access for employees

To ensure that only compliant and authorized devices can access the network

To monitor network traffic for anomalies

A security administrator is configuring a network boundary device. The requirement is to block known malicious traffic patterns, but also to allow legitimate traffic that may vary slightly from known signatures. The administrator wants to minimize false positives. Which deployment should they choose?

Deploy an intrusion prevention system (IPS) in inline mode with default signatures

Deploy an intrusion detection system (IDS) in passive mode and tune the signatures based on observed traffic

Deploy a stateful firewall with no application-layer inspection

Deploy a packet sniffer and manually review all traffic

GIAC Information Security Professional

Domain 2Objective 3

Communication and Network Security GISP Practice Questions (Page 1)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 1–5

1application · medium
A company is deploying a new web application that will be accessed by customers over the internet. The application server must be reachable from the public internet, but the database server must only be reachable from the application server. The security team wants to minimize the attack surface. Which network design best meets these requirements?
Select an answer first
2foundation · easy
Which protocol suite is commonly used to implement site-to-site VPNs by encrypting IP packets?
Select an answer first
3application · medium
A company needs to connect its headquarters to a branch office over the internet. The traffic will carry sensitive financial data, and the security team requires encryption and integrity protection for all traffic between the two sites. Which solution should be selected?
Select an answer first
4foundation · easy
What is the primary goal of Network Access Control (NAC)?
Select an answer first
5application · medium
A security administrator is configuring a network boundary device. The requirement is to block known malicious traffic patterns, but also to allow legitimate traffic that may vary slightly from known signatures. The administrator wants to minimize false positives. Which deployment should they choose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Communication and Network Security GISP Practice Questions (Page 1)

Questions 1–5

Which protocol suite is commonly used to implement site-to-site VPNs by encrypting IP packets?

A company needs to connect its headquarters to a branch office over the internet. The traffic will carry sensitive financial data, and the security team requires encryption and integrity protection for all traffic between the two sites. Which solution should be selected?

What is the primary goal of Network Access Control (NAC)?

Keep studying — Security Architecture and Operations