A company is deploying a new application that requires low latency between two server groups. The servers are currently on different floors, connected through a core switch and a router. The network architect wants to reduce latency. Which change is most effective?

Use a firewall with stateful inspection between the server groups.

Increase the MTU on the router.

Move both server groups to the same VLAN and subnet, eliminating the need for routing.

A network forensic analyst is examining a packet capture from a compromised host. The capture shows an ARP request for the default gateway's IP address, followed by a TCP connection to an external IP. The analyst suspects ARP spoofing. Which evidence in the capture would confirm this?

The TCP connection uses a high source port.

Multiple ARP replies to the same request with different MAC addresses.

The ARP request is sent to a unicast MAC address.

The ARP request is broadcast, and the TCP connection is established.

GIAC Network Forensic Analyst

Domain 1Objective 2

Network Architecture GNFA Practice Questions (Page 7)

Part of the Network Fundamentals and Architecture domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 9–16 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 31–35

31expert · medium
A company is deploying a new application that requires low latency between two server groups. The servers are currently on different floors, connected through a core switch and a router. The network architect wants to reduce latency. Which change is most effective?
Select an answer first
32expert · hard
A network forensic analyst is examining a packet capture from a compromised host. The capture shows an ARP request for the default gateway's IP address, followed by a TCP connection to an external IP. The analyst suspects ARP spoofing. Which evidence in the capture would confirm this?
Select an answer first
33application · medium
A hospital is designing its network to ensure that if one switch fails, the connected devices can still communicate through alternate paths. Which topology should the network architect choose?
Select an answer first
34application · medium
A network administrator is troubleshooting intermittent connectivity between two departments on different floors. The connection passes through a switch, a router, and a firewall. Which device is most likely to be responsible for forwarding traffic between the two different IP subnets?
Select an answer first
35foundation · easy
A security analyst needs to block all inbound traffic to a web server except on port 443. Which device is specifically designed to enforce such access control policies based on rules?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Network Architecture GNFA Practice Questions (Page 7)

Questions 31–35

A company is deploying a new application that requires low latency between two server groups. The servers are currently on different floors, connected through a core switch and a router. The network architect wants to reduce latency. Which change is most effective?

A network forensic analyst is examining a packet capture from a compromised host. The capture shows an ARP request for the default gateway's IP address, followed by a TCP connection to an external IP. The analyst suspects ARP spoofing. Which evidence in the capture would confirm this?

A hospital is designing its network to ensure that if one switch fails, the connected devices can still communicate through alternate paths. Which topology should the network architect choose?

A network administrator is troubleshooting intermittent connectivity between two departments on different floors. The connection passes through a switch, a router, and a firewall. Which device is most likely to be responsible for forwarding traffic between the two different IP subnets?

A security analyst needs to block all inbound traffic to a web server except on port 443. Which device is specifically designed to enforce such access control policies based on rules?

Keep studying — Network Fundamentals and Architecture