A small business is considering a unified threat management (UTM) appliance to replace its existing firewall, antivirus gateway, and content filter. The business is concerned about performance because the UTM will be placed inline at the internet edge. Which factor is most important to evaluate when selecting the UTM to avoid performance degradation?

The physical size of the UTM appliance

The brand name of the UTM vendor

The number of security features included in the UTM

The throughput rating of the UTM with all security features enabled

A security operations center (SOC) is overwhelmed with alerts from multiple IDS/IPS and firewall devices. Analysts are missing critical alerts because they cannot correlate events across systems. The team wants to reduce alert fatigue and improve detection of multi-stage attacks. Which solution is most appropriate?

Deploy a SIEM system to aggregate and correlate logs from all security devices

Replace all IDS/IPS devices with a single UTM appliance

Deploy a network access control (NAC) system to block non-compliant devices

Increase the sensitivity of the IDS/IPS signatures to generate more alerts

A security analyst needs to monitor a high-throughput research network for suspicious traffic patterns. The network carries time-sensitive scientific data, and any dropped or delayed packets could corrupt experiments. The analyst wants to detect anomalies and generate alerts, but must not affect the flow of traffic. Which device should be deployed?

An intrusion detection system (IDS) connected to a switch SPAN port

An intrusion prevention system (IPS) placed inline at the network gateway

A network access control (NAC) system enforcing endpoint compliance

A next-generation firewall (NGFW) with intrusion prevention enabled

A security operations team needs a centralized view of security events from firewalls, IDS/IPS, and servers. The team wants to correlate events across these sources to detect multi-stage attacks and support incident response. Which system should be implemented?

A network access control (NAC) system

A security information and event management (SIEM) system

A unified threat management (UTM) appliance

GIAC Security Essentials

Domain 2Objective 2

Network Security Devices GSEC Practice Questions (Page 8)

Part of the Network Security domain, which makes up ~17% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 4–7 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

13concepts

Questions 36–40

36expert · hard
A small business is considering a unified threat management (UTM) appliance to replace its existing firewall, antivirus gateway, and content filter. The business is concerned about performance because the UTM will be placed inline at the internet edge. Which factor is most important to evaluate when selecting the UTM to avoid performance degradation?
Select an answer first
37expert · hard
A security operations center (SOC) is overwhelmed with alerts from multiple IDS/IPS and firewall devices. Analysts are missing critical alerts because they cannot correlate events across systems. The team wants to reduce alert fatigue and improve detection of multi-stage attacks. Which solution is most appropriate?
Select an answer first
38application · medium
A security analyst needs to monitor a high-throughput research network for suspicious traffic patterns. The network carries time-sensitive scientific data, and any dropped or delayed packets could corrupt experiments. The analyst wants to detect anomalies and generate alerts, but must not affect the flow of traffic. Which device should be deployed?
Select an answer first
39application · medium
A security operations team needs a centralized view of security events from firewalls, IDS/IPS, and servers. The team wants to correlate events across these sources to detect multi-stage attacks and support incident response. Which system should be implemented?
Select an answer first
40application · medium
A company wants to reduce bandwidth usage by caching frequently accessed websites and also wants to log and filter employee web requests. The solution must act as an intermediary between clients and the internet. Which device should be deployed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Network Security Devices GSEC Practice Questions (Page 8)

Questions 36–40

A security operations team needs a centralized view of security events from firewalls, IDS/IPS, and servers. The team wants to correlate events across these sources to detect multi-stage attacks and support incident response. Which system should be implemented?

A company wants to reduce bandwidth usage by caching frequently accessed websites and also wants to log and filter employee web requests. The solution must act as an intermediary between clients and the internet. Which device should be deployed?

Keep studying — Network Security