A network administrator notices that an internal server is sending a large volume of ICMP echo replies to an external IP address. The source IP of the replies is the server's own address, but the administrator knows the server did not initiate any ICMP requests. Which attack is occurring and what is the most effective immediate countermeasure?

Smurf attack; disable ICMP on the server

DNS amplification; rate-limit DNS responses on the server

ARP poisoning; enable dynamic ARP inspection on the switch

IP spoofing; configure ingress and egress filtering on the perimeter firewall

A company is deploying a multi-tier application in a cloud environment. The security team wants to implement micro-segmentation to limit lateral movement. The application consists of web servers, application servers, and database servers. Which approach best implements micro-segmentation in this environment?

Use network security groups (NSGs) or security groups to allow traffic only between specific tiers (e.g., web to app, app to db) and deny all other traffic

Use a single firewall at the internet gateway to protect all tiers

Place all tiers in the same subnet and rely on host-based firewalls on each server

Use a VPN between each tier to encrypt traffic

An organization's executives need to send sensitive documents via email. The current email system does not support native encryption. The security team must ensure that email content is encrypted in transit and at rest, and that recipients can verify the sender's identity. Which solution should they implement?

A secure webmail portal accessed over HTTPS

S/MIME with digital certificates for each executive and recipient

TLS for the SMTP connection between mail servers

A password-protected ZIP file attached to the email

A hospital's network has a shared flat segment for medical devices, staff workstations, and the public guest Wi-Fi. After a ransomware infection spread from a guest laptop to an MRI machine, the security team must isolate these groups. Which approach best limits the attack surface while maintaining necessary communication?

Place each group in a separate VLAN with firewall rules allowing only required traffic between them

Install host-based firewalls on every workstation and medical device

Deploy an IPS at the internet gateway only

Disable the guest Wi-Fi network entirely

GIAC Information Security Professional

Domain 2Objective 3

Communication and Network Security GISP Practice Questions (Page 4)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 16–20

16application · medium
A network administrator notices that an internal server is sending a large volume of ICMP echo replies to an external IP address. The source IP of the replies is the server's own address, but the administrator knows the server did not initiate any ICMP requests. Which attack is occurring and what is the most effective immediate countermeasure?
Select an answer first
17expert · hard
A company is deploying a multi-tier application in a cloud environment. The security team wants to implement micro-segmentation to limit lateral movement. The application consists of web servers, application servers, and database servers. Which approach best implements micro-segmentation in this environment?
Select an answer first
18foundation · easy
Which wireless security protocol is considered the most secure among the following?
Select an answer first
19application · medium
An organization's executives need to send sensitive documents via email. The current email system does not support native encryption. The security team must ensure that email content is encrypted in transit and at rest, and that recipients can verify the sender's identity. Which solution should they implement?
Select an answer first
20application · medium
A hospital's network has a shared flat segment for medical devices, staff workstations, and the public guest Wi-Fi. After a ransomware infection spread from a guest laptop to an MRI machine, the security team must isolate these groups. Which approach best limits the attack surface while maintaining necessary communication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Communication and Network Security GISP Practice Questions (Page 4)

Questions 16–20

Which wireless security protocol is considered the most secure among the following?

Keep studying — Security Architecture and Operations