An organization wants to provide secure remote access for a small number of administrators to manage network devices. They want to avoid exposing the management interfaces directly to the internet. Which solution is most appropriate?

Use a jump host in the DMZ that is accessible from the internet and then RDP to internal devices.

Set up a VPN concentrator in the DMZ and require administrators to connect through the VPN to reach management interfaces on the internal network.

Configure SSH on the border router and forward port 22 to each internal device.

Expose the management interfaces on the internet and protect them with strong passwords.

A company hosts a public web server and an internal HR system. The web server must be reachable from the internet, but the HR system must only be reachable from the internal network. Which network design best satisfies these requirements?

Place the web server in the DMZ and the HR system on the internal network, with firewall rules allowing inbound HTTP/HTTPS to the DMZ only.

Place both servers on the internal network and allow inbound traffic to both through the firewall.

Place both servers in the DMZ to simplify firewall rules.

Place the HR system in the DMZ and the web server on the internal network.

What is the core principle of the Zero Trust model?

Trust users and devices inside the network by default

Trust external users more than internal users

Rely on a strong perimeter firewall to protect all internal resources

Verify every request as if it originates from an untrusted network

Which type of system is specifically designed to analyze network traffic for signs of malicious activity and generate alerts?

Intrusion Detection System (IDS)

A company is designing a redundant data center network. They have two data centers and want to ensure that if one data center fails, the other can take over with minimal downtime. They also need to maintain segmentation between tiers. Which design best meets these requirements?

Use active-active data centers with load balancing and replicate the same segmentation policies across both sites.

Use a single data center with a backup tape drive.

Use a single data center with redundant power and cooling.

Use active-passive data centers but do not replicate firewall rules.

GIAC Security Essentials

Domain 2Objective 1

Defensible Network Architecture GSEC Practice Questions (Page 8)

Part of the Network Security domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 4–7 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

8concepts

Questions 36–40

36application · medium
An organization wants to provide secure remote access for a small number of administrators to manage network devices. They want to avoid exposing the management interfaces directly to the internet. Which solution is most appropriate?
Select an answer first
37application · medium
A company hosts a public web server and an internal HR system. The web server must be reachable from the internet, but the HR system must only be reachable from the internal network. Which network design best satisfies these requirements?
Select an answer first
38foundation · easy
What is the core principle of the Zero Trust model?
Select an answer first
39foundation · easy
Which type of system is specifically designed to analyze network traffic for signs of malicious activity and generate alerts?
Select an answer first
40expert · hard
A company is designing a redundant data center network. They have two data centers and want to ensure that if one data center fails, the other can take over with minimal downtime. They also need to maintain segmentation between tiers. Which design best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.