A security operations center (SOC) is reviewing network traffic logs and notices a large amount of encrypted traffic (TLS) from a single internal host to a cloud service provider. The traffic volume is significantly higher than normal for that host. The SOC wants to determine if the traffic is malicious without decrypting the traffic. Which approach is most effective?

Deploy a TLS interception proxy to decrypt and inspect the traffic

Block all traffic to the cloud service provider

Ignore the traffic because it is encrypted and cannot be analyzed

Use NetFlow or similar flow data to analyze the destination IP, port, and traffic patterns, and compare against threat intelligence

A company is deploying a multi-tenant cloud environment where different business units must be isolated from each other. The security team wants to implement micro-segmentation to limit lateral movement. They also need to maintain the ability to apply consistent security policies across all workloads. Which approach should they use?

Implement software-defined networking (SDN) with distributed firewall policies applied at the virtual network interface level

Place all workloads in a single subnet and rely on host firewalls

Use network security groups (NSGs) but only at the subnet level

Use traditional VLANs and a central firewall to segment each business unit

A company allows employees to bring their own devices (BYOD) to the office. The security team wants to ensure that only devices that meet the company's security policy (e.g., updated OS, enabled encryption) can access the corporate network. Which solution should be deployed?

A firewall that blocks all inbound traffic from the internet

A strong WPA2-Personal passphrase for the corporate Wi-Fi

Network Access Control (NAC) that checks device compliance before granting access

A VPN that requires two-factor authentication for remote access

GIAC Information Security Professional

Domain 2Objective 3

Communication and Network Security GISP Practice Questions (Page 7)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 58 practice questions to prepare you well beyond it. (estimate)

58questions here

12free pages

12concepts

Questions 31–35

31expert · hard
A security operations center (SOC) is reviewing network traffic logs and notices a large amount of encrypted traffic (TLS) from a single internal host to a cloud service provider. The traffic volume is significantly higher than normal for that host. The SOC wants to determine if the traffic is malicious without decrypting the traffic. Which approach is most effective?
Select an answer first
32foundation · easy
Which secure protocol is specifically designed to provide encrypted remote shell access to a server?
Select an answer first
33foundation · easy
Which technology is commonly used to create logical network segmentation within a single physical switch?
Select an answer first
34expert · hard
A company is deploying a multi-tenant cloud environment where different business units must be isolated from each other. The security team wants to implement micro-segmentation to limit lateral movement. They also need to maintain the ability to apply consistent security policies across all workloads. Which approach should they use?
Select an answer first
35application · medium
A company allows employees to bring their own devices (BYOD) to the office. The security team wants to ensure that only devices that meet the company's security policy (e.g., updated OS, enabled encryption) can access the corporate network. Which solution should be deployed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Communication and Network Security GISP Practice Questions (Page 7)

Questions 31–35

Which secure protocol is specifically designed to provide encrypted remote shell access to a server?

Which technology is commonly used to create logical network segmentation within a single physical switch?

A company allows employees to bring their own devices (BYOD) to the office. The security team wants to ensure that only devices that meet the company's security policy (e.g., updated OS, enabled encryption) can access the corporate network. Which solution should be deployed?

Keep studying — Security Architecture and Operations