A cloud architect needs to isolate a web application's front-end servers from its database servers. Which combination of components provides the most direct network segmentation?

A single virtual network with no subnets and no NSGs

Separate virtual networks with no peering

A single subnet with NSGs applied only to the database server's network interface

Separate subnets with network security groups (NSGs) applied to each subnet

A healthcare organization must ensure that network logs are tamper-proof and cannot be modified by attackers. They are using NSG flow logs. Which configuration should they implement?

Enable diagnostic settings and send logs to a storage account with no public access.

Store logs in a separate VNet with an NSG that blocks all inbound traffic.

Export logs to an immutable storage account with WORM (write once, read many) policy.

Send logs to a Log Analytics workspace with Azure Defender for Cloud enabled.

A financial services company must retain network security logs for at least one year to meet regulatory requirements. They are using NSG flow logs and sending them to a Log Analytics workspace. What should be configured to ensure the logs are retained for the required period?

Export the logs to a third-party SIEM and rely on their retention policy.

Set the retention period of the Log Analytics workspace to 365 days.

Enable diagnostic settings on the NSG to send logs to a storage account with a lifecycle management policy.

Create an Azure Monitor alert rule to notify when logs are older than 365 days.

Which practice is essential to meet compliance requirements for virtual network logging?

Enabling NSG flow logs and retaining them for the period required by the applicable regulation

Using only manual log reviews to avoid automated tool costs

Disabling all logging to reduce the attack surface

Storing logs only in the region where the resources are deployed

GIAC Public Cloud Security

Domain 3Objective 2

Virtual Network Security and Logging GPCS Practice Questions (Page 4)

Part of the Network and Compliance Security domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

6concepts

Questions 16–20

16foundation · easy
A cloud architect needs to isolate a web application's front-end servers from its database servers. Which combination of components provides the most direct network segmentation?
Select an answer first
17application · medium
A security team needs to monitor network traffic between VMs in a VNet for anomaly detection. They want to capture metadata about all allowed and denied flows, including source and destination IPs, ports, and protocol. Which logging solution should they enable?
Select an answer first
18application · medium
A healthcare organization must ensure that network logs are tamper-proof and cannot be modified by attackers. They are using NSG flow logs. Which configuration should they implement?
Select an answer first
19application · medium
A financial services company must retain network security logs for at least one year to meet regulatory requirements. They are using NSG flow logs and sending them to a Log Analytics workspace. What should be configured to ensure the logs are retained for the required period?
Select an answer first
20foundation · easy
Which practice is essential to meet compliance requirements for virtual network logging?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPCS” is a trademark of its owner, used for identification only.