A company is implementing a zero trust model and wants to replace their traditional VPN with a more granular access solution. They need to support remote users accessing specific applications without granting access to the entire network. Which solution is most appropriate?

Use a VPN with split tunneling to only route traffic to specific applications.

Deploy a zero trust network access (ZTNA) solution that provides application-level access based on user identity and device posture.

Use a remote desktop gateway to provide access to individual applications.

Use a traditional VPN and rely on firewall rules to restrict access to specific applications.

A security operations team is investigating a potential data breach. They have firewall logs, DNS logs, and NetFlow data. They suspect that an attacker is using a compromised internal host to exfiltrate data to an external server. Which combination of data sources would most effectively confirm the exfiltration?

NetFlow data alone to see the volume of traffic from the internal host.

Firewall logs alone to see if the internal host is allowed to communicate with the external server.

DNS logs alone to see if the internal host is resolving a suspicious domain.

NetFlow data to see the volume and destination of traffic from the internal host, and DNS logs to see if the host is resolving a domain associated with the external server.

A security architect is designing a network for a small business. They want to implement defense in depth without overcomplicating the environment. Which set of controls best exemplifies defense in depth?

A perimeter firewall, an internal segmentation firewall, host-based firewalls on critical servers, and centralized logging.

A VPN for remote access and a DMZ for public servers.

Antivirus on all endpoints and a strong password policy.

A single strong perimeter firewall with strict rules and no internal segmentation.

A security administrator is hardening a network that includes legacy systems that cannot be patched. The administrator wants to reduce the risk of these systems being used for lateral movement. Which approach is most effective?

Place the legacy systems in a separate network segment with strict firewall rules that only allow necessary communication, and monitor all traffic to and from that segment.

Use host-based firewalls on the legacy systems to restrict inbound traffic.

Disable the legacy systems' network access entirely.

Apply virtual patches using an intrusion prevention system (IPS) on the network.

An administrator is hardening internal Windows servers to reduce the risk of lateral movement. Which combination of actions best achieves this goal?

Install the latest antivirus and enable automatic updates only.

Enable all Windows services to ensure functionality and rely on the network firewall for protection.

Disable the host-based firewall to avoid interference with legitimate traffic.

Disable unnecessary services and apply host-based firewall rules that restrict inbound connections to only required ports.

GIAC Security Essentials

Domain 2Objective 1

Defensible Network Architecture GSEC Practice Questions (Page 4)

Part of the Network Security domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 16–20

16expert · hard
A company is implementing a zero trust model and wants to replace their traditional VPN with a more granular access solution. They need to support remote users accessing specific applications without granting access to the entire network. Which solution is most appropriate?
Select an answer first
17expert · hard
A security operations team is investigating a potential data breach. They have firewall logs, DNS logs, and NetFlow data. They suspect that an attacker is using a compromised internal host to exfiltrate data to an external server. Which combination of data sources would most effectively confirm the exfiltration?
Select an answer first
18application · medium
A security architect is designing a network for a small business. They want to implement defense in depth without overcomplicating the environment. Which set of controls best exemplifies defense in depth?
Select an answer first
19expert · hard
A security administrator is hardening a network that includes legacy systems that cannot be patched. The administrator wants to reduce the risk of these systems being used for lateral movement. Which approach is most effective?
Select an answer first
20application · medium
An administrator is hardening internal Windows servers to reduce the risk of lateral movement. Which combination of actions best achieves this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.