A security team wants to detect suspicious lateral movement within a segmented network. They have deployed a SIEM and are collecting logs from firewalls and servers. Which additional data source would most directly help identify an attacker moving between segments?

NetFlow or other flow logs from core switches and routers.

Email gateway logs for inbound and outbound messages.

Physical access logs for the data center.

DNS query logs from the internal DNS server.

Which hardening technique is most effective at reducing the attack surface of an internal network host?

Disabling the host firewall to improve performance

Disabling unnecessary services and closing unused ports

Using the same password for all administrative accounts

Increasing the number of open ports for future use

What is the purpose of a failover mechanism in a high-availability network design?

To automatically switch traffic to a standby component when the primary component fails

To increase the encryption strength of network traffic

To block malicious traffic before it reaches the network

To provide a backup of user data for disaster recovery

A security administrator is hardening internal Windows servers to reduce the risk of lateral movement. Which combination of measures is most effective for this goal?

Place all servers in the same VLAN and use a shared local admin account for management.

Install the latest antivirus on each server and schedule daily full scans.

Disable unnecessary services, apply the principle of least privilege to local admin rights, and enable Windows Firewall with default-deny inbound rules.

Enable Remote Desktop on all servers for easier administration and rely on a strong password policy.

An organization is moving to a zero trust model. They have a mix of legacy applications that do not support modern authentication protocols and modern cloud apps. They want to enforce least privilege and continuous verification without breaking legacy apps. Which approach best balances security and compatibility?

Require all legacy apps to support SAML or OAuth before allowing access.

Use a VPN for all access and rely on network-level controls only.

Keep legacy apps on a flat network and apply zero trust only to cloud apps.

Implement micro-segmentation for all workloads and use an identity-aware proxy for legacy apps that cannot support modern protocols.

GIAC Security Essentials

Domain 2Objective 1

Defensible Network Architecture GSEC Practice Questions (Page 6)

Part of the Network Security domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 26–30

26application · medium
A security team wants to detect suspicious lateral movement within a segmented network. They have deployed a SIEM and are collecting logs from firewalls and servers. Which additional data source would most directly help identify an attacker moving between segments?
Select an answer first
27foundation · easy
Which hardening technique is most effective at reducing the attack surface of an internal network host?
Select an answer first
28foundation · easy
What is the purpose of a failover mechanism in a high-availability network design?
Select an answer first
29application · medium
A security administrator is hardening internal Windows servers to reduce the risk of lateral movement. Which combination of measures is most effective for this goal?
Select an answer first
30expert · hard
An organization is moving to a zero trust model. They have a mix of legacy applications that do not support modern authentication protocols and modern cloud apps. They want to enforce least privilege and continuous verification without breaking legacy apps. Which approach best balances security and compatibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.