Defensible Network Architecture GSEC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is designing a monitoring solution for a segmented network. They want to detect an attacker who has gained access to a low-trust zone and is attempting to move to a high-trust zone. Which monitoring approach would be most effective?

   • AUse a SIEM to correlate logs from all devices in the network.
   • BCollect logs from all servers in the high-trust zone and review them periodically.
   • CDeploy honeypots in the high-trust zone to detect unauthorized access.
   • DDeploy network sensors at the boundaries between zones to monitor all cross-zone traffic and alert on anomalies.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of network monitoring and logging in a defensible network architecture?

   • ATo detect and respond to suspicious activity
   • BTo replace the need for firewalls
   • CTo automatically block all malicious traffic
   • DTo increase network speed by reducing packet loss
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is designing a redundant internet edge. They have two ISPs and two firewalls. They want to ensure that if one ISP link fails, traffic automatically fails over to the other ISP without manual intervention. Which design best achieves this?

   • AConfigure each firewall to connect to a different ISP and use BGP with the ISPs to advertise the company's public IP space.
   • BUse a load balancer in front of the firewalls and configure it to send traffic to the active firewall.
   • CConfigure static routes on the border router to each ISP and rely on manual failover.
   • DConnect both firewalls to the same ISP and use a single public IP address.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization has a segmented network with a PCI DSS zone. They need to harden the internal network to prevent lateral movement from a compromised workstation to the PCI zone. They also need to maintain visibility for compliance. Which approach best meets these requirements?

   • ADisable host-based firewalls to avoid interfering with compliance scanning.
   • BEnable logging only on the PCI zone firewall.
   • CApply host-based firewalls on all endpoints and servers, and enable centralized logging of all firewall events.
   • DUse network segmentation only and rely on the network firewall to block all traffic to the PCI zone.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A large enterprise is transitioning to a zero trust architecture. They have a mix of on-premises data center and cloud workloads. The security team wants to enforce continuous verification of user and device identity for every access request, regardless of network location. Which approach best aligns with zero trust principles while balancing operational complexity?

   • AUse a next-generation firewall at the perimeter and enforce strict rules for inbound traffic.
   • BDeploy an identity-aware proxy in front of all applications that requires MFA and device posture checks for every session, and use micro-segmentation policies to limit east-west traffic.
   • CMove all workloads to the cloud and use the cloud provider's native security groups.
   • DImplement a traditional VPN for all remote users and rely on network segmentation to protect workloads.
   Reveal Solution Discussion Select an answer first