Defensible Network Architecture GSEC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An administrator is hardening internal Linux servers. Which action is most effective at reducing the attack surface and limiting lateral movement?

   • ADisable the host-based firewall to avoid blocking legitimate traffic.
   • BInstall a graphical desktop environment to improve usability.
   • CDisable unused services and apply host-based firewall rules that restrict inbound connections to only required ports.
   • DEnable SSH password authentication for all users for convenience.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's internet-facing services must remain available even if one firewall fails. They have a single ISP connection. Which design best improves availability?

   • AConfigure the firewall to automatically reboot on failure.
   • BDeploy two firewalls in an active-passive HA pair with a virtual IP and automatic failover.
   • CUse a single firewall with a higher throughput model.
   • DPlace a load balancer in front of the firewall.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team wants to detect suspicious activity within their segmented network. They have a central SIEM and need to ensure they can correlate events across segments. Which approach best supports this?

   • AForward logs from firewalls, servers, and switches to the SIEM and enable alerts for cross-segment traffic anomalies.
   • BUse a network tap on the core switch and capture all traffic without analysis.
   • CStore logs locally on each device and review them only when an incident occurs.
   • DEnable logging only on the perimeter firewall.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which authentication method is strongly recommended for remote access solutions to provide an additional layer of security beyond a password?

   • APassword-only authentication
   • BSingle sign-on (SSO)
   • CMAC address filtering
   • DMulti-factor authentication (MFA)
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is designing a network for a research lab that handles sensitive data. They need to allow collaboration with external partners but must prevent partners from accessing internal systems. They also want to minimize the risk of data exfiltration. Which design best meets these requirements?

   • ACreate a separate partner zone with its own firewall rules, and use a data loss prevention (DLP) solution to monitor data transfers.
   • BGive partners direct access to the internal network through a VPN.
   • CPlace partners on the same VLAN as internal users and rely on shared folders for collaboration.
   • DUse a DMZ for partner access but allow all traffic from the DMZ to the internal network.
   Reveal Solution Discussion Select an answer first