During a network security incident, the incident response team discovers that an attacker has been moving laterally across the network for several weeks. The team needs to contain the incident while preserving evidence for a potential legal case. Which action should the team take first?

Disconnect the entire network from the internet to prevent further exfiltration.

Begin reimaging the affected systems to ensure the attacker's tools are removed.

Isolate the affected systems from the network while preserving volatile data and capturing memory images.

Immediately shut down all affected servers to stop the attacker's activity.

During a security incident, a network administrator discovers that an attacker has established a foothold on a critical server and is using it to scan the internal network. The incident response plan requires containment, but the business cannot afford downtime for that server. Which containment strategy best balances the need to stop the attack with the need to keep the server available?

Shut down the server and restore from backup.

Use host-based firewall rules to block outbound scanning traffic while allowing legitimate business traffic.

Disconnect the server from the network immediately to stop the scanning.

Move the server to a separate VLAN and continue monitoring.

GIAC Security Leadership

Domain 2Objective 2

Managing Network Security GSLC Practice Questions (Page 1)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 1–5

1expert · hard
During a network security incident, the incident response team discovers that an attacker has been moving laterally across the network for several weeks. The team needs to contain the incident while preserving evidence for a potential legal case. Which action should the team take first?
Select an answer first
2foundation · easy
Which technique is commonly used to isolate a compromised system from the rest of the network?
Select an answer first
3foundation · easy
Which network monitoring tool captures and analyzes network traffic to identify suspicious patterns?
Select an answer first
4expert · hard
During a security incident, a network administrator discovers that an attacker has established a foothold on a critical server and is using it to scan the internal network. The incident response plan requires containment, but the business cannot afford downtime for that server. Which containment strategy best balances the need to stop the attack with the need to keep the server available?
Select an answer first
5foundation · easy
Which regulatory framework is specifically designed to protect the privacy of personal data of individuals in the European Union?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Managing Network Security GSLC Practice Questions (Page 1)

Questions 1–5

During a network security incident, the incident response team discovers that an attacker has been moving laterally across the network for several weeks. The team needs to contain the incident while preserving evidence for a potential legal case. Which action should the team take first?

Which technique is commonly used to isolate a compromised system from the rest of the network?

Which network monitoring tool captures and analyzes network traffic to identify suspicious patterns?

Which regulatory framework is specifically designed to protect the privacy of personal data of individuals in the European Union?

Keep studying — Technical Security Management