A security operations center (SOC) is analyzing network traffic and notices that a server is sending data to an external IP address on a non-standard port. The traffic is encrypted, and the server is supposed to only communicate with internal systems. The SOC needs to determine if this is a data exfiltration attempt. Which action should they take first?

Block the external IP address at the firewall immediately

Reboot the server to clear any malicious processes

Ignore the traffic because it is encrypted and cannot be analyzed

Check the server's process list and network connections to identify which application is generating the traffic

A hospital is deploying a wireless network for staff laptops and mobile devices. The security policy requires that only authorized devices can join the network and that each user's traffic is encrypted individually. Which wireless security configuration should the administrator implement?

WPA2-Personal with a pre-shared key

WPA2-Enterprise with 802.1X and per-user certificates

Open network with MAC address filtering

A security analyst notices repeated TCP SYN packets sent to a public web server from many different source IP addresses, none of which complete the three-way handshake. The server's connection table is filling up and legitimate users are experiencing timeouts. Which immediate mitigation should the analyst implement at the network perimeter?

Block all inbound TCP traffic to the server

Configure the firewall to drop packets from the spoofed source addresses

Increase the server's TCP connection timeout value

Enable SYN cookies on the server's operating system

A security analyst is reviewing network logs and notices repeated failed SSH login attempts from a single external IP address to multiple internal servers. The attempts are increasing in frequency. Which immediate action should the analyst take to mitigate this brute-force attack?

Block the external IP address at the perimeter firewall

Ignore the attempts because they are only log entries

Disable SSH on all internal servers

Increase the SSH authentication timeout on the servers

GIAC Information Security Professional

Domain 2Objective 3

Communication and Network Security GISP Practice Questions (Page 11)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 51–55

51expert · hard
A security operations center (SOC) is analyzing network traffic and notices that a server is sending data to an external IP address on a non-standard port. The traffic is encrypted, and the server is supposed to only communicate with internal systems. The SOC needs to determine if this is a data exfiltration attempt. Which action should they take first?
Select an answer first
52application · medium
A hospital is deploying a wireless network for staff laptops and mobile devices. The security policy requires that only authorized devices can join the network and that each user's traffic is encrypted individually. Which wireless security configuration should the administrator implement?
Select an answer first
53foundation · easy
Which security goal is most directly supported by implementing redundant network links and failover mechanisms?
Select an answer first
54application · medium
A security analyst notices repeated TCP SYN packets sent to a public web server from many different source IP addresses, none of which complete the three-way handshake. The server's connection table is filling up and legitimate users are experiencing timeouts. Which immediate mitigation should the analyst implement at the network perimeter?
Select an answer first
55application · medium
A security analyst is reviewing network logs and notices repeated failed SSH login attempts from a single external IP address to multiple internal servers. The attempts are increasing in frequency. Which immediate action should the analyst take to mitigate this brute-force attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Communication and Network Security GISP Practice Questions (Page 11)

Questions 51–55

A hospital is deploying a wireless network for staff laptops and mobile devices. The security policy requires that only authorized devices can join the network and that each user's traffic is encrypted individually. Which wireless security configuration should the administrator implement?

Which security goal is most directly supported by implementing redundant network links and failover mechanisms?

A security analyst is reviewing network logs and notices repeated failed SSH login attempts from a single external IP address to multiple internal servers. The attempts are increasing in frequency. Which immediate action should the analyst take to mitigate this brute-force attack?

Keep studying — Security Architecture and Operations