A security analyst is investigating a suspected ARP spoofing attack on a wired LAN segment. The analyst wants to confirm the attack and then implement a mitigation that does not disrupt legitimate traffic. Which combination of actions should the analyst take?

Check the ARP cache on a victim machine for duplicate IP-to-MAC mappings, then enable Dynamic ARP Inspection (DAI) on the switch

Check the switch's MAC address table for multiple ports with the same MAC, then block the attacker's port manually

Disable ARP on the victim machine and use static ARP entries

Use a packet sniffer to capture ARP traffic, then configure a firewall rule to block ARP packets

A company is migrating a multi-tier application to a cloud environment. The security team wants to ensure that the web tier can communicate with the application tier, but the application tier cannot initiate connections to the web tier. They also want to isolate each tier from the others. Which cloud networking approach should they use?

Create separate subnets for each tier and use network security groups (NSGs) with rules that allow only the required inbound traffic from the web tier to the application tier

Use a single network security group for all tiers with a rule allowing all traffic

Place all tiers in the same subnet and rely on host-based firewalls

Connect all tiers to the same virtual network and use public IP addresses for communication

What is the primary function of a firewall?

To filter traffic based on a set of security rules

To authenticate users before they access the network

To detect and alert on suspicious traffic patterns

What is the key difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?

IDS is placed inline, while IPS is placed out-of-band

IDS is a hardware device, while IPS is software

IDS uses signatures, while IPS uses anomaly detection

IDS is passive and only alerts, while IPS is active and can block traffic

GIAC Information Security Professional

Domain 2Objective 3

Communication and Network Security GISP Practice Questions (Page 5)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 21–25

21expert · hard
A security analyst is investigating a suspected ARP spoofing attack on a wired LAN segment. The analyst wants to confirm the attack and then implement a mitigation that does not disrupt legitimate traffic. Which combination of actions should the analyst take?
Select an answer first
22application · medium
A company is migrating a multi-tier application to a cloud environment. The security team wants to ensure that the web tier can communicate with the application tier, but the application tier cannot initiate connections to the web tier. They also want to isolate each tier from the others. Which cloud networking approach should they use?
Select an answer first
23foundation · easy
What is the primary function of a firewall?
Select an answer first
24foundation · easy
Which type of network attack involves an attacker intercepting and reading data as it travels across a network?
Select an answer first
25foundation · easy
What is the key difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Communication and Network Security GISP Practice Questions (Page 5)

Questions 21–25

A security analyst is investigating a suspected ARP spoofing attack on a wired LAN segment. The analyst wants to confirm the attack and then implement a mitigation that does not disrupt legitimate traffic. Which combination of actions should the analyst take?

What is the primary function of a firewall?

Which type of network attack involves an attacker intercepting and reading data as it travels across a network?

What is the key difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?

Keep studying — Security Architecture and Operations