A security analyst notices repeated failed RDP login attempts from a single external IP against a public-facing jump server. The attempts occur every few minutes and have been ongoing for two hours. The analyst wants to confirm whether any login succeeded before taking action. Which monitoring data source would provide the most definitive evidence?

Firewall logs showing the source IP and destination port 3389

Authentication logs from the jump server's operating system

Intrusion detection system alerts triggered by the RDP brute-force pattern

NetFlow data from the core switch showing traffic volume to the jump server

What is the primary purpose of a network security policy?

To provide a detailed network diagram for administrators

To record all past security incidents

To list all hardware and software inventory

To define rules and expectations for protecting network resources

A network administrator is configuring a monitoring system to detect potential security incidents. The administrator wants to receive alerts when a user attempts to access a server without proper authorization. Which monitoring technique is most appropriate for this purpose?

Deploy a honeypot that mimics the server and wait for attackers to interact with it.

Configure the intrusion detection system to alert on failed authentication attempts and unusual access patterns.

Enable verbose logging on all servers and review the logs manually once a month.

Use a network firewall to block all traffic from unknown IP addresses.

GIAC Security Leadership

Domain 2Objective 2

Managing Network Security GSLC Practice Questions (Page 7)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 31–35

31application · medium
A security analyst notices repeated failed RDP login attempts from a single external IP against a public-facing jump server. The attempts occur every few minutes and have been ongoing for two hours. The analyst wants to confirm whether any login succeeded before taking action. Which monitoring data source would provide the most definitive evidence?
Select an answer first
32foundation · easy
Which security architecture concept involves implementing multiple layers of security controls to protect network resources?
Select an answer first
33foundation · easy
Which of the following is a common network vulnerability that can be exploited by attackers to gain unauthorized access?
Select an answer first
34foundation · easy
What is the primary purpose of a network security policy?
Select an answer first
35application · medium
A network administrator is configuring a monitoring system to detect potential security incidents. The administrator wants to receive alerts when a user attempts to access a server without proper authorization. Which monitoring technique is most appropriate for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Managing Network Security GSLC Practice Questions (Page 7)

Questions 31–35

Which security architecture concept involves implementing multiple layers of security controls to protect network resources?

Which of the following is a common network vulnerability that can be exploited by attackers to gain unauthorized access?

What is the primary purpose of a network security policy?

A network administrator is configuring a monitoring system to detect potential security incidents. The administrator wants to receive alerts when a user attempts to access a server without proper authorization. Which monitoring technique is most appropriate for this purpose?

Keep studying — Technical Security Management