A financial services company is deploying a new public-facing web application. The security architect must ensure that the application is protected from both network-layer attacks and application-layer attacks, while also ensuring that the web servers are not directly reachable from the internet. The company has a limited budget and wants to minimize the number of devices. Which approach is most effective?

Deploy an intrusion prevention system (IPS) inline and place the web servers directly on the internal network

Deploy a web application firewall (WAF) in front of the web servers and a separate packet-filtering firewall at the perimeter

Deploy a next-generation firewall (NGFW) at the perimeter and place the web servers in a DMZ behind it

Deploy a load balancer with SSL termination and place the web servers in a DMZ

A company wants to allow employees to access external websites while also preventing malware downloads and enforcing acceptable-use policies. They are considering a proxy server. However, the security team is concerned that a proxy could become a performance bottleneck and that some applications may not work through a proxy. Which approach best addresses these concerns?

Deploy a reverse proxy in front of the internal web servers

Deploy a forward proxy with caching and URL filtering, and configure it to bypass for trusted internal applications

Deploy a network access control (NAC) system to enforce acceptable-use policies

Deploy a stateful firewall with URL filtering enabled

A security operations center (SOC) is overwhelmed by the volume of alerts from its SIEM. The team wants to reduce false positives while still detecting real threats. The SIEM receives logs from firewalls, IDS/IPS, and servers. Which approach is most effective for reducing alert fatigue?

Implement correlation rules that combine multiple low-severity events into a single high-severity alert

Disable all alerts from the IDS/IPS because they generate too many false positives

Increase the logging level on all devices to capture more data

Use a network access control (NAC) system to block non-compliant devices

GIAC Security Essentials

Domain 2Objective 2

Network Security Devices GSEC Practice Questions (Page 2)

Part of the Network Security domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 4–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

13concepts

Questions 6–10

6expert · hard
A financial services company is deploying a new public-facing web application. The security architect must ensure that the application is protected from both network-layer attacks and application-layer attacks, while also ensuring that the web servers are not directly reachable from the internet. The company has a limited budget and wants to minimize the number of devices. Which approach is most effective?
Select an answer first
7foundation · easy
A security administrator needs to identify a device that inspects incoming and outgoing traffic and makes allow/deny decisions based on a configured set of rules. Which device performs this role?
Select an answer first
8foundation · easy
A web application is experiencing performance issues because all users are hitting a single server. Which device would help distribute the load across multiple servers?
Select an answer first
9expert · hard
A company wants to allow employees to access external websites while also preventing malware downloads and enforcing acceptable-use policies. They are considering a proxy server. However, the security team is concerned that a proxy could become a performance bottleneck and that some applications may not work through a proxy. Which approach best addresses these concerns?
Select an answer first
10expert · hard
A security operations center (SOC) is overwhelmed by the volume of alerts from its SIEM. The team wants to reduce false positives while still detecting real threats. The SIEM receives logs from firewalls, IDS/IPS, and servers. Which approach is most effective for reducing alert fatigue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Network Security Devices GSEC Practice Questions (Page 2)

Questions 6–10

A security administrator needs to identify a device that inspects incoming and outgoing traffic and makes allow/deny decisions based on a configured set of rules. Which device performs this role?

A web application is experiencing performance issues because all users are hitting a single server. Which device would help distribute the load across multiple servers?

A security operations center (SOC) is overwhelmed by the volume of alerts from its SIEM. The team wants to reduce false positives while still detecting real threats. The SIEM receives logs from firewalls, IDS/IPS, and servers. Which approach is most effective for reducing alert fatigue?

Keep studying — Network Security