Which network security control is primarily used to establish a secure, encrypted tunnel over an untrusted network?

Intrusion detection system (IDS)

A network administrator notices unusual outbound traffic from a workstation to a known malicious IP address. The workstation is also exhibiting high CPU usage and sending repeated requests to internal file shares. Which type of threat is most likely indicated by these symptoms?

A malware infection that is communicating with a command-and-control server and attempting to spread laterally.

A phishing email that tricked the user into revealing their password.

A network switch that is failing and causing broadcast storms.

A misconfigured application that is sending telemetry to an external service.

A network administrator notices that a server in the data center is sending a large amount of traffic to an external IP address on port 53 (DNS). The traffic is not consistent with normal DNS queries. The administrator suspects the server is part of a DNS amplification attack. What should the administrator do first to confirm the suspicion?

Rebuild the server from a known-good image.

Check the server's DNS logs to see if it is responding to recursive queries from external sources.

Increase the server's DNS cache size to handle the traffic.

Block all outbound DNS traffic from the server immediately.

What is the primary purpose of a Security Information and Event Management (SIEM) system?

To aggregate and correlate security events from multiple sources

To manage user identities and access rights

To block malicious traffic in real time

GIAC Security Leadership

Domain 2Objective 2

Managing Network Security GSLC Practice Questions (Page 8)

Part of the Technical Security Management domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 4–6 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 36–40

36foundation · easy
Which industry standard is specifically designed to protect cardholder data?
Select an answer first
37foundation · easy
Which network security control is primarily used to establish a secure, encrypted tunnel over an untrusted network?
Select an answer first
38application · medium
A network administrator notices unusual outbound traffic from a workstation to a known malicious IP address. The workstation is also exhibiting high CPU usage and sending repeated requests to internal file shares. Which type of threat is most likely indicated by these symptoms?
Select an answer first
39application · medium
A network administrator notices that a server in the data center is sending a large amount of traffic to an external IP address on port 53 (DNS). The traffic is not consistent with normal DNS queries. The administrator suspects the server is part of a DNS amplification attack. What should the administrator do first to confirm the suspicion?
Select an answer first
40foundation · easy
What is the primary purpose of a Security Information and Event Management (SIEM) system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.

Managing Network Security GSLC Practice Questions (Page 8)

Questions 36–40

Which industry standard is specifically designed to protect cardholder data?

Which network security control is primarily used to establish a secure, encrypted tunnel over an untrusted network?

A network administrator notices unusual outbound traffic from a workstation to a known malicious IP address. The workstation is also exhibiting high CPU usage and sending repeated requests to internal file shares. Which type of threat is most likely indicated by these symptoms?

What is the primary purpose of a Security Information and Event Management (SIEM) system?

Keep studying — Technical Security Management