A bank's core banking application must remain available even if a network switch fails. The application servers are connected to two switches, but the current configuration uses only one path. Which change should be made to improve resilience?

Connect each server to both switches and use a spanning tree protocol (STP) to provide a redundant path.

Increase the bandwidth of the single connection to the switch.

Configure link aggregation (LACP) between the servers and switches to provide redundancy.

Place the servers in a different VLAN to isolate them from the switch failure.

Which approach is most effective for controlling traffic between a high-security zone and a lower-trust zone?

Placing both zones on the same flat network segment

Disabling logging on the boundary device to improve performance

Using a firewall or ACL to enforce a deny-by-default policy at the zone boundary

Allowing all traffic because both zones are internal

A financial services firm is architecting its perimeter security. They want to detect and block known malicious signatures, but also want to identify anomalous traffic patterns that may indicate a zero-day attack. They have budget for both a firewall and one additional security device. Which combination should they choose?

Deploy an intrusion detection system (IDS) in passive mode and rely on the firewall logs for anomaly detection.

Replace the firewall with a next-generation firewall that includes both signature-based and anomaly-based detection.

Deploy an intrusion prevention system (IPS) inline after the firewall, and use NetFlow or similar telemetry to feed an anomaly detection system.

Use a network tap to send all traffic to a security information and event management (SIEM) system for analysis.

A company is designing a network for a new office. They want to segment the network to protect the finance department's systems from the general user network. However, they also want to allow the finance team to access the internet and email. Which segmentation strategy is most appropriate?

Create a separate VLAN for finance and use a firewall to allow only necessary traffic, such as email and internet, while blocking other internal access.

Put finance systems in the DMZ to isolate them from both internal and external networks.

Use a VPN for all finance traffic, routing it through a separate gateway.

Place finance systems on the same VLAN as general users but use host-based firewalls on finance computers.

Which practice is most important for ensuring that network logs are useful in a security investigation?

Disabling logging on high-volume devices to improve performance

Storing logs only on the device that generated them

Synchronizing clocks across all devices using NTP

Deleting logs after 24 hours to save storage

GIAC Security Leadership

Domain 6Objective 2

Network Security Architecture GSLC Practice Questions (Page 2)

Part of the Network and Security Architecture domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 4–6 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

8concepts

Questions 6–10

6application · medium
A bank's core banking application must remain available even if a network switch fails. The application servers are connected to two switches, but the current configuration uses only one path. Which change should be made to improve resilience?
Select an answer first
7foundation · easy
Which approach is most effective for controlling traffic between a high-security zone and a lower-trust zone?
Select an answer first
8application · medium
A financial services firm is architecting its perimeter security. They want to detect and block known malicious signatures, but also want to identify anomalous traffic patterns that may indicate a zero-day attack. They have budget for both a firewall and one additional security device. Which combination should they choose?
Select an answer first
9expert · hard
A company is designing a network for a new office. They want to segment the network to protect the finance department's systems from the general user network. However, they also want to allow the finance team to access the internet and email. Which segmentation strategy is most appropriate?
Select an answer first
10foundation · easy
Which practice is most important for ensuring that network logs are useful in a security investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSLC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSLC” is a trademark of its owner, used for identification only.