What is the primary purpose of network segmentation in a defense-in-depth strategy?

To isolate sensitive systems and limit the impact of a compromise

To eliminate the need for firewalls and other security devices

To increase the speed of the network by reducing congestion

To provide a backup path for network traffic in case of failure

A company is migrating to a cloud-based infrastructure. The security team must ensure that data is protected in transit and at rest, and that only authorized users can access resources. They also want to reduce the risk of credential theft. Which combination of controls is most effective?

Rely on the cloud provider's default security settings and do not change them.

Use a VPN for all access and store encryption keys in the same cloud account.

Implement a data loss prevention (DLP) policy and monitor all user activity.

Enable encryption in transit (TLS) and at rest (server-side encryption), implement multi-factor authentication (MFA) for all users, and use role-based access control (RBAC).

What is the primary purpose of a mantrap in physical security?

To monitor network traffic for suspicious activity

To provide backup power in case of an outage

To control the flow of people and prevent tailgating

To detect and extinguish fires in the data center

A company wants to protect its customer database. Which combination of controls best demonstrates defense-in-depth?

Use strong passwords for all users

Encrypt the database, restrict access to authorized users, and monitor access logs

Install a firewall and do nothing else

A financial institution is required to protect customer data both at rest and in transit. The security architect must choose a set of controls that satisfies compliance while minimizing performance impact on the database. Which approach is most appropriate?

Apply column-level encryption to all sensitive fields and use SSH tunneling for remote access.

Encrypt the entire server's hard drive with BitLocker and use a VPN for all database connections.

Store data in an encrypted file system and rely on the network firewall to protect data in transit.

Use transparent data encryption (TDE) for the database and enforce TLS for all client connections.

GIAC Security Essentials

Domain 1Objective 2

Defense in Depth GSEC Practice Questions (Page 7)

Part of the Foundations of Security domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 3–6 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

9concepts

Questions 31–35

31foundation · easy
What is the primary purpose of network segmentation in a defense-in-depth strategy?
Select an answer first
32expert · hard
A company is migrating to a cloud-based infrastructure. The security team must ensure that data is protected in transit and at rest, and that only authorized users can access resources. They also want to reduce the risk of credential theft. Which combination of controls is most effective?
Select an answer first
33foundation · easy
What is the primary purpose of a mantrap in physical security?
Select an answer first
34foundation · easy
A company wants to protect its customer database. Which combination of controls best demonstrates defense-in-depth?
Select an answer first
35expert · hard
A financial institution is required to protect customer data both at rest and in transit. The security architect must choose a set of controls that satisfies compliance while minimizing performance impact on the database. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.