A defense contractor is designing a system to handle classified documents. The requirement is that a user with a Top Secret clearance can read a Secret document, but a user with only Secret clearance must not be able to read a Top Secret document. Which security model directly enforces this read restriction?

Brewer-Nash (Chinese Wall) model

A company is designing a network for a new office. They want to separate the finance department's systems from the general employee network to limit the impact of a compromise. Which network architecture approach best achieves this?

Create a separate VLAN for the finance department and use a firewall to control traffic between VLANs

Use a single firewall at the internet edge and no internal segmentation

Place all systems on the same flat network and rely on host-based firewalls

Connect all devices to a single switch and use MAC address filtering

A government agency is purchasing a new firewall product. They require assurance that the product has been independently evaluated against a standard set of security functional and assurance requirements. Which evaluation scheme should they look for?

ISO 27001 certification of the vendor

A penetration test report from the vendor

A company is designing a new data center. They want to protect against both physical intrusion and logical attacks. The security architect must balance cost and effectiveness. Which combination of controls provides the best balance?

Mantraps and air-gapped networks

Biometric access controls on the data center door and network segmentation with firewalls

A single lock on the front door and no network segmentation

CCTV cameras only and a flat network

GIAC Information Security Professional

Domain 2Objective 1

Security Architecture and Engineering GISP Practice Questions (Page 11)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

12concepts

Questions 51–55

51foundation · easy
Which technology is used to create a secure, encrypted tunnel over an untrusted network?
Select an answer first
52application · medium
A defense contractor is designing a system to handle classified documents. The requirement is that a user with a Top Secret clearance can read a Secret document, but a user with only Secret clearance must not be able to read a Top Secret document. Which security model directly enforces this read restriction?
Select an answer first
53application · medium
A company is designing a network for a new office. They want to separate the finance department's systems from the general employee network to limit the impact of a compromise. Which network architecture approach best achieves this?
Select an answer first
54application · medium
A government agency is purchasing a new firewall product. They require assurance that the product has been independently evaluated against a standard set of security functional and assurance requirements. Which evaluation scheme should they look for?
Select an answer first
55expert · hard
A company is designing a new data center. They want to protect against both physical intrusion and logical attacks. The security architect must balance cost and effectiveness. Which combination of controls provides the best balance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security Architecture and Engineering GISP Practice Questions (Page 11)

Questions 51–55

Which technology is used to create a secure, encrypted tunnel over an untrusted network?

A company is designing a network for a new office. They want to separate the finance department's systems from the general employee network to limit the impact of a compromise. Which network architecture approach best achieves this?

A government agency is purchasing a new firewall product. They require assurance that the product has been independently evaluated against a standard set of security functional and assurance requirements. Which evaluation scheme should they look for?

A company is designing a new data center. They want to protect against both physical intrusion and logical attacks. The security architect must balance cost and effectiveness. Which combination of controls provides the best balance?

Keep studying — Security Architecture and Operations