A security team is implementing zero trust and wants to detect anomalous behavior within their micro-segmented environment. They have a SIEM and want to baseline normal traffic patterns. Which approach best supports this?

Collect flow logs from all segments and use the SIEM to establish baselines and alert on deviations.

Disable logging to improve performance.

Use a network tap on the core switch and store raw packets without analysis.

Enable logging only on the perimeter firewall.

A company is adopting a zero trust model. They want to implement micro-segmentation to limit lateral movement. Which approach best aligns with zero trust principles?

Use VLANs for each department but allow all traffic between VLANs.

Create separate firewall rules for each application or workload, allowing only the specific traffic required for that workload to communicate.

Place all workloads in a single flat network and rely on the corporate firewall at the perimeter.

Implement a strong password policy and require MFA for all users.

An organization wants to implement zero trust principles in its data center. They want to limit lateral movement even if a workload is compromised. Which approach best aligns with zero trust?

Deploy a NAC solution that only checks device compliance at login.

Rely on the perimeter firewall and assume the internal network is trusted.

Use a flat network with strong host-based antivirus on every server.

Implement micro-segmentation with per-workload firewall policies and continuous verification of identity and device posture.

A security analyst needs to detect an attacker moving laterally from the DMZ to the internal network. Which monitoring approach is most effective?

Monitor firewall logs for outbound connections from the DMZ to internal IP addresses on unusual ports.

Monitor DNS queries from internal hosts to external domains.

Review server logs only after a breach is reported.

Monitor only inbound traffic from the internet to the DMZ.

A company wants to provide remote access to its internal file shares for employees using personal laptops. They require strong authentication and want to ensure that if a laptop is compromised, the internal network is not directly exposed. Which solution best meets these requirements?

Use a remote desktop gateway without MFA.

Deploy a VPN with endpoint posture checking and MFA, and restrict access to specific file share servers.

Provide employees with a VPN but do not enforce MFA.

Expose the file share servers directly to the internet with password protection.

GIAC Security Essentials

Domain 2Objective 1

Defensible Network Architecture GSEC Practice Questions (Page 7)

Part of the Network Security domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 31–35

31expert · hard
A security team is implementing zero trust and wants to detect anomalous behavior within their micro-segmented environment. They have a SIEM and want to baseline normal traffic patterns. Which approach best supports this?
Select an answer first
32application · medium
A company is adopting a zero trust model. They want to implement micro-segmentation to limit lateral movement. Which approach best aligns with zero trust principles?
Select an answer first
33application · medium
An organization wants to implement zero trust principles in its data center. They want to limit lateral movement even if a workload is compromised. Which approach best aligns with zero trust?
Select an answer first
34application · medium
A security analyst needs to detect an attacker moving laterally from the DMZ to the internal network. Which monitoring approach is most effective?
Select an answer first
35application · medium
A company wants to provide remote access to its internal file shares for employees using personal laptops. They require strong authentication and want to ensure that if a laptop is compromised, the internal network is not directly exposed. Which solution best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.