GSEC Defensible Network Architecture — All Questions With Answers

Question 1

A healthcare organization is redesigning its data center to meet HIPAA segmentation requirements. The security architect must ensure that the web tier, application tier, and database tier can only communicate with adjacent tiers, and that no tier can initiate connections directly to the database except the application tier. The organization wants to enforce this using a single physical firewall with the fewest possible interfaces. Which deployment best meets these requirements?

Accepted Answer

Deploy the firewall in routed mode with three interfaces, one per tier, and write rules that permit only web-to-app and app-to-db flows.. Segmenting the web, application, and database tiers into separate firewall interfaces creates distinct security zones. Inter-zone traffic must pass through the firewall, where a default-deny posture and explicit permits for web-to-app and app-to-db enforce the required flow. The database zone has no inbound rule from the web zone, so direct connections are blocked. This approach provides clear policy enforcement, logging, and auditability with a single firewall.

Answer

Deploy the firewall in a one-armed (router-on-a-stick) configuration with a single physical interface carrying all three tiers as subinterfaces.

Answer

Deploy the firewall in transparent mode between each tier, using separate VLANs and 802.1Q trunking to enforce inter-VLAN policies.

Answer

Deploy the firewall in routed mode with two interfaces, placing the web and application tiers on the same interface and the database on the other.

Question 2

A security engineer is reviewing the design of a demilitarized zone (DMZ) that hosts a public web server, a mail relay, and a DNS server. The current design places all three servers on the same VLAN behind a single firewall interface, and the firewall allows any DMZ host to initiate connections to any other DMZ host. The engineer wants to reduce the blast radius if one server is compromised. Which change BEST achieves this goal while preserving required service functionality?

Accepted Answer

Enable private VLANs (PVLANs) on the DMZ switch so each server is an isolated port, and allow only the firewall promiscuous port to communicate with all isolated ports.. Segmenting the DMZ so each public-facing server cannot initiate connections to its peers limits lateral movement after a compromise. Private VLANs provide that isolation at Layer 2 while the firewall's promiscuous port retains the ability to broker all required inbound and outbound flows. Moving servers inward, authenticating ports, or adding Layer 2 anti-spoofing controls do not break the peer-to-peer reachability that enables east-west spread.

Answer

Move all three servers to the internal trusted VLAN and rely on host-based firewalls on each server to block unwanted internal connections.

Answer

Configure 802.1X with MAC authentication bypass on the DMZ switch ports so only known servers can connect to the DMZ VLAN.

Answer

Enable DHCP snooping and dynamic ARP inspection on the DMZ VLAN to prevent ARP spoofing between the three servers.

Question 3

A security team is building a defensible architecture for a new branch office that connects to headquarters over the public internet. The design must protect data confidentiality and integrity in transit and must prevent a compromised branch router from silently redirecting traffic to an attacker. Which two design elements best satisfy these requirements? (Choose two.)

Accepted Answer

Establish an IPsec VPN tunnel between the branch router and the headquarters VPN concentrator using IKEv2 with certificate-based authentication and strong encryption and integrity algorithms.. Confidentiality and integrity across an untrusted path require encryption and authentication of the traffic itself, which IPsec delivers whether as a point-to-point IKEv2 tunnel or as an IPsec-protected DMVPN overlay. Routing authentication and static routes harden control-plane behavior but leave payloads in cleartext and do not constrain a router that an attacker already controls. Only cryptographic protection of the data path meets both stated goals.

Answer

Configure the branch router with static routes to headquarters and enable unicast reverse path forwarding on all interfaces.

Answer

Deploy a routing protocol authentication mechanism such as OSPF or BGP MD5/TCP-AO authentication on the branch-to-headquarters routing adjacencies.

Answer

Rely on the public internet's native BGP security and TLS on application traffic to protect the branch-to-headquarters path.

Question 4

An enterprise network administrator needs to isolate a new public-facing web application so that a compromise of the web server does not immediately expose the internal corporate database and directory services. Which network architecture design pattern provides the most effective defense for this scenario?

Accepted Answer

Configuring a demilitarized zone (DMZ) flanked by firewalls to separate public-facing web assets from internal network resources.. Deploying a demilitarized zone (DMZ) creates a buffered network segment between the untrusted public internet and the trusted internal corporate network. By placing the web server in the DMZ and utilizing firewalls to restrict inbound and outbound traffic flows, administrators successfully contain potential breaches. This defensive architecture stops attackers from pivoting directly into sensitive internal resources following an initial web application compromise.

Answer

Deploying the web server on the internal corporate VLAN alongside domain controllers to streamline administrative access and reduce network latency.

Answer

Implementing a flat network topology utilizing unmanaged switches to maximize throughput and simplify routing tables for incoming web traffic.

Answer

Connecting the web server directly to the outer provider edge router via a public bridge to bypass internal switching bottlenecks.

Question 5

A security engineer is designing a secure enterprise environment and needs to deploy network intrusion detection sensors to monitor east-west traffic moving between virtual machines inside an internal virtualization cluster. Which deployment method ensures the sensors successfully inspect internal segment traffic without introducing a single point of failure for packet forwarding?

Accepted Answer

Configuring hypervisor-level distributed virtual switches to mirror east-west traffic to dedicated virtual security monitoring appliances.. Using virtual tap interfaces or distributed software switches configured for port mirroring allows security sensors to receive copies of internal traffic traversing the hypervisor backplane. This approach ensures comprehensive visibility into east-west lateral movement without altering inline packet forwarding paths, maintaining network availability while delivering the necessary telemetry for threat detection engines.

Answer

Placing a dedicated physical inline bump-in-the-wire network intrusion prevention system between every internal virtual switch uplink.

Answer

Routing all inter-VLAN traffic through a single legacy perimeter firewall using hardware router-on-a-stick configurations.

Answer

Disabling all stateful packet inspection on internal firewalls to allow maximum throughput for east-west virtualization traffic.

Question 6

An organization is hardening its internal corporate network architecture to prevent unauthorized hosts from connecting to switch ports in common areas and conference rooms. Which TWO configurations should the network engineering team implement to achieve this security objective? (Choose TWO)

Accepted Answer

Enabling 802.1X port-based authentication integrated with a RADIUS server and extensible authentication protocol.. Implementing 802.1X port-based authentication forces every connecting device to authenticate against a central directory service before gaining network access. Combined with port security limits that restrict the maximum number of registered MAC addresses per switch port, organizations effectively block rogue devices and unauthorized hardware from establishing unauthorized network connections in public areas.

Answer

Configuring static routing protocols on all access layer switches to bypass dynamic route poisoning attacks.

Answer

Deploying unmanaged network hubs in conference rooms to simplify physical cable management and port density.

Answer

Disabling spanning tree protocol root guard on all core enterprise switches to accelerate topology convergence times.

Question 7

During an internal network security audit, an engineer discovers that workstations on the human resources VLAN can directly communicate with sensitive database servers on the finance VLAN without passing through a filtering device. Which foundational architectural control is missing from this environment?

Accepted Answer

Enforcing inter-VLAN access control lists or deploying an internal firewall to inspect and restrict traffic between functional zones.. Micro-segmentation and internal routing firewalls are essential for enforcing least privilege communication between distinct functional business units. When VLANs reside on a core router or multi-layer switch without inter-VLAN access control lists, traffic flows freely between security zones. Implementing internal firewalls between these segments ensures that human resources workstations only access authorized HR applications.

Answer

Deploying a high-availability server load balancer in front of the human resources workstation subnet.

Answer

Upgrading all edge routers to support Border Gateway Protocol with strict cryptographic route validation.

Answer

Replacing all traditional dynamic host configuration protocol scopes with static IP address assignments.

Question 8

A security architect is hardening an organization's network infrastructure against reconnaissance and layer-2 attacks. Which TWO actions should the engineering team take to mitigate common switch-based vulnerabilities? (Choose TWO)

Accepted Answer

Disabling dynamic trunking protocol on all user-facing access layer switch ports.. Mitigating layer-2 vulnerabilities requires disabling dynamic trunking protocol auto-negotiation and explicitly setting native VLAN identifiers to unused, isolated values. Disabling dynamic trunk negotiation stops rogue switches from forming trunk links, while changing the native VLAN prevents VLAN hopping attacks that exploit un-tagged traffic handling on trunk links.

Answer

Enabling dynamic ARP inspection across all core routing interfaces without configuring DHCP snooping bindings.

Answer

Routing all broadcast domain traffic through unmanaged Layer-1 repeating hubs to obscure physical topology.

Answer

Installing public-facing web servers directly into the native management VLAN of the core enterprise switches.

Question 9

An enterprise network design utilizes an out-of-band management network for all core routers, firewalls, and switches. The management network is physically separated from the production data plane and uses dedicated management switches. What is the primary security advantage of this defensible architecture?

Accepted Answer

It prevents compromised production workloads from launching lateral attacks against device management planes.. An out-of-band management network isolates administrative traffic from production data flows, ensuring that an operational disruption or compromise of the data plane does not lock administrators out of their infrastructure devices. This separation prevents lateral movement from compromised user workstations directly into device management interfaces, protecting critical administrative access paths.

Answer

It completely eliminates the requirement to encrypt administrative SSH and HTTPS sessions across the network core.

Answer

It automatically accelerates routing convergence times across all enterprise boundary routers by removing administrative overhead.

Answer

It allows network operators to utilize unauthenticated cleartext telnet connections without risking confidentiality breaches.

Question 10

Refer to the exhibit. A network administrator configured port security on a switch interface to protect against unauthorized device connections. Based on the provided configuration snippet, what action will the switch take if a third device with an unknown MAC address connects to this port?

Accepted Answer

The switch will immediately transition the interface into an error-disabled state and shut down port operations.. When port security is configured with a maximum limit of two MAC addresses and a violation mode of shutdown, the switch immediately disables the interface the moment a third unique MAC address attempts to communicate. The port enters an error-disabled state, dropping all traffic until an administrator manually resets the interface or configures an automatic recovery timer.

Answer

The switch will forward the third device's traffic while generating an alert log entry to the central syslog server without dropping packets.

Answer

The switch will drop packets originating from the third device while keeping the physical port in an active operational state.

Answer

The switch will temporarily quarantine the third device in a restricted guest VLAN while awaiting administrator approval.

Question 11

A security team is designing a resilient perimeter architecture to protect internal services from distributed denial of service attacks and web application exploits. Which THREE architectural components must be incorporated into this design? (Choose THREE)

Accepted Answer

A dedicated web application firewall to inspect HTTP and HTTPS traffic for application-layer vulnerabilities and injection attacks.. A robust perimeter defense requires multiple layers of inspection and mitigation. Web application firewalls inspect application-layer HTTP and HTTPS traffic to block injection attacks, hardware DDoS mitigation scrubbing centers absorb volumetric network floods upstream, and redundant boundary firewalls enforce stateful perimeter access control policies while eliminating single points of failure.

Answer

Unmanaged Layer-1 hubs placed directly outside the perimeter firewall to mirror raw traffic into analysis buffers.

Answer

Disabling all stateful inspection engines on perimeter firewalls to maximize throughput for inbound HTTPS sessions.

Question 12

A financial services firm is deploying a new high-security network segment for trading systems. The security team wants to prevent unauthorized devices from communicating on the segment even if they physically connect to an access switch port. The chosen solution must authenticate the device before any network access is granted and must integrate with the existing RADIUS server. Which technology should be implemented?

Accepted Answer

802.1X with EAP-TLS and RADIUS on the access switch ports.. 802.1X with EAP-TLS enforces authentication at the switch port before any network access is granted. The switch acts as an authenticator, passing credentials to the RADIUS server. Until the supplicant presents a valid certificate, only EAPoL traffic is allowed, preventing unauthorized devices from communicating. This integrates with the existing RADIUS infrastructure and provides strong, certificate-based identity verification suitable for high-security trading systems.

Answer

Private VLANs (PVLANs) with isolated ports for each trading system.

Answer

MACsec (802.1AE) encryption on all switch uplinks.

Answer

Port security with sticky MAC addresses on each access port.

Question 13

A security engineer is segmenting a data center so that contractors who maintain HVAC systems cannot initiate connections into the server VLAN, but the internal monitoring platform must still reach the contractor subnet to poll building-management sensors. The chosen design uses a stateful firewall between the two zones with the contractor zone as the untrusted side. Which configuration best enforces the required traffic direction while preserving monitoring?

Accepted Answer

Configure the firewall so the monitoring platform initiates sessions into the contractor zone, allowing only established, return traffic back to the monitoring platform.. The requirement is directional control between zones, so a stateful firewall must see the trusted monitoring platform initiate the session and then allow only the return traffic for that established flow. Contractors are thereby unable to originate connections into the server VLAN, while polling of building-management sensors continues. Stateless ACLs and private addressing do not provide this session-aware, one-way enforcement.

Answer

Place both zones behind a single perimeter firewall and permit all inter-zone traffic, relying on the contractor VLAN's private IP addressing to prevent reachability.

Answer

Apply an ACL on the contractor zone's router interface that permits only the monitoring platform's IP to the sensor subnet and denies all other traffic in both directions.

Answer

Configure a stateful firewall rule permitting the contractor subnet to the sensor subnet on the management ports, and add an implicit deny at the end of the rule base.

Question 14

An architect is designing a defensible architecture that must detect reconnaissance scanning against a sensitive research subnet without alerting on normal vulnerability-scanner traffic that the security team runs weekly from an authorized scanner host. The design will use an intrusion detection sensor on a SPAN port. Which combination of capabilities best meets the requirement?

Accepted Answer

Deploy a signature-based IDS tuned to scan signatures and configure a pass rule for the authorized scanner's IP address above the scan-detection rules.. Suppression must be tied to the identity of the authorized scanner, and a pass rule ordered ahead of the scan-detection signatures achieves that on a signature-based sensor. Other sources probing the research subnet still generate alerts, so reconnaissance remains detectable. Anomaly baselining, disabled signatures, and volume thresholds all fail because they suppress or remove detection without distinguishing the trusted scanner from an attacker.

Answer

Deploy an anomaly-based IDS with a baseline that includes the weekly scanner, and alert only when traffic deviates from that baseline.

Answer

Deploy a signature-based IDS and disable all scan-detection signatures, relying on firewall logs to reveal reconnaissance activity.

Answer

Deploy a signature-based IDS and configure a suppression threshold that ignores any source generating more than one hundred alerts per hour.

Question 15

A network architect is designing a new data center fabric that must support a large number of tenants with strict isolation requirements. The design uses a spine-leaf topology with VXLAN overlay. The architect must ensure that broadcast, unknown unicast, and multicast (BUM) traffic from one tenant never reaches another tenant's virtual tunnel endpoints (VTEPs). Which mechanism should be implemented to meet this requirement?

Accepted Answer

Assign each tenant a unique VXLAN Network Identifier (VNI) and map each VNI to a separate bridge domain on every leaf switch.. In a VXLAN overlay, tenant isolation is achieved by assigning each tenant a distinct VNI and bridge domain. VTEPs flood BUM traffic only within the same VNI, so segments remain logically separate even though they share the same physical spine-leaf fabric. IGMP snooping, anycast gateway MACs, and separate physical fabrics do not provide the required per-tenant Layer 2 boundary in a shared overlay.

Answer

Enable IGMP snooping on all leaf switches so multicast traffic is pruned to only the ports that requested the group.

Answer

Configure a unique anycast gateway MAC address on each leaf switch to prevent hosts from roaming between tenants.

Answer

Use a separate physical spine-leaf fabric for each tenant and interconnect them with a firewall.

Question 16

A security administrator is configuring a screened subnet (DMZ) firewall rule set. The organization wants to allow external users to reach a public web server on TCP 443 while preventing the web server from initiating connections back into the internal network. Which rule set BEST enforces this requirement?

Accepted Answer

Permit any external IP to the web server on TCP 443; deny the web server to any internal IP on all ports; permit established return traffic from the web server to external clients.. A screened subnet firewall policy should permit only the specific public service, block the DMZ host from initiating connections into the internal network, and allow return traffic for established sessions. The rule set that permits external HTTPS, denies the web server to internal IPs, and permits established return traffic achieves this. Overly broad inbound rules or rules that allow inward initiation from the DMZ undermine the security boundary.

Answer

Permit any external IP to the web server on any port; deny the web server to any internal IP on all ports.

Answer

Deny all external IPs to the web server; permit the web server to any external IP on TCP 443.

Answer

Permit any external IP to the web server on TCP 443; permit the web server to any internal IP on TCP 443 only.

Question 17

A junior administrator is asked to make a web server reachable from the internet without exposing the internal database server that the web application uses. The web server sits in a screened subnet, and the database resides on the internal network. Which architecture correctly implements this requirement?

Accepted Answer

Place the web server in the screened subnet with inbound HTTP and HTTPS permitted from the internet, and permit only the web server's IP to reach the database on its listening port.. A screened subnet isolates internet-facing services from internal data stores, and restricting database access to the web server's address enforces that boundary at the network layer. Internet clients reach only the web tier, so compromising it does not grant direct access to the database or the broader internal network. Co-locating the database in the screened subnet or opening its listener to any source undermines the isolation the design requires.

Answer

Place the web server in the screened subnet and enable a database listener that accepts connections from any source, relying on database authentication to prevent unauthorized access.

Answer

Place both the web server and the database in the screened subnet, and permit inbound HTTP and HTTPS from the internet to the web server.

Answer

Place the web server on the internal network and publish it through a reverse proxy that forwards requests directly to the database server.

Question 18

A security engineer is deploying a network-based intrusion detection system (NIDS) to monitor traffic entering and leaving a data center. The engineer needs to ensure the sensor can see all packets, including those that are fragmented or have errors, without affecting the production traffic flow. Which deployment method should be used?

Accepted Answer

Connect the NIDS to a switched port analyzer (SPAN) port that mirrors all traffic from the core switch.. A passive NIDS deployment using a SPAN port mirrors copies of production traffic to the sensor, allowing full packet inspection without adding latency or risk to the live traffic path. Inline placement can affect production flow, virtual switch promiscuous mode only sees local host traffic, and NetFlow provides summaries rather than full packets. The SPAN port best satisfies the need to see all packets, including fragmented and error frames.

Answer

Configure the NIDS to receive a copy of traffic via NetFlow exports from the core routers.

Answer

Place the NIDS inline between the core switch and the data center router using a fail-open bypass tap.

Answer

Install the NIDS on a virtual machine and connect it to a virtual switch in promiscuous mode on the same host as the web servers.

Question 19

A security architect must ensure that hosts on a guest wireless network cannot reach any internal RFC 1918 subnets, while still allowing guests to reach the internet and a captive portal hosted internally for authentication. The design uses a wireless controller that tunnels guest traffic to a dedicated guest anchor. Which approach best enforces the requirement?

Accepted Answer

Assign guests addresses from an isolated guest subnet and apply an ACL on the guest anchor that denies traffic to all internal RFC 1918 ranges while permitting the captive portal host and internet-bound traffic.. Guest traffic tunneled to a dedicated anchor can be filtered where it enters the network, and an ACL that denies RFC 1918 destinations while permitting the captive portal and internet traffic enforces exactly the stated policy. Client isolation, core-level blanket drops, and route publication either fail to block internal access or break required services. The anchor is the correct enforcement point because it sees all guest traffic before it reaches internal resources.

Answer

Assign guests addresses from an isolated guest subnet and publish a route to the internal network, relying on the internal firewalls' implicit deny to block guest access.

Answer

Assign guests addresses from an isolated guest subnet and configure the internal core switches to drop all traffic sourced from that subnet.

Answer

Assign guests addresses from the internal corporate DHCP scope and rely on the wireless controller's client isolation feature to prevent guests from reaching internal hosts.

Question 20

A security architect is designing a defensible network architecture for a new campus. The architect must implement controls that limit the spread of malware from an infected endpoint to other endpoints on the same VLAN. Which TWO actions should be included in the design? (Choose two.)

Accepted Answer

Implement 802.1X with dynamic VLAN assignment so endpoints are placed into role-based segments based on identity and posture.. Limiting malware spread on a campus network requires segmenting endpoints at Layer 2. 802.1X with dynamic VLAN assignment places devices into role-based segments, and private VLANs prevent direct host-to-host communication within a VLAN. Together they reduce the blast radius of an infection. Honeypots, DHCP snooping with IP Source Guard, and host-based IPS improve detection or integrity but do not provide the network segmentation needed to contain lateral movement.

Answer

Implement a host-based intrusion prevention system (HIPS) on every endpoint to block malicious traffic at the source.

Answer

Deploy a honeypot on each VLAN to detect and automatically blackhole infected endpoints.

Answer

Configure DHCP snooping and IP Source Guard on all access ports to validate endpoint IP and MAC bindings.

GSEC Defensible Network Architecture — All Questions With Answers

An organization is hardening its internal corporate network architecture to prevent unauthorized hosts from connecting to switch ports in common areas and conference rooms. Which TWO configurations should the network engineering team implement to achieve this security objective? (Choose TWO)

A security architect is hardening an organization's network infrastructure against reconnaissance and layer-2 attacks. Which TWO actions should the engineering team take to mitigate common switch-based vulnerabilities? (Choose TWO)

Refer to the exhibit. A network administrator configured port security on a switch interface to protect against unauthorized device connections. Based on the provided configuration snippet, what action will the switch take if a third device with an unknown MAC address connects to this port?

Exhibit

A security team is designing a resilient perimeter architecture to protect internal services from distributed denial of service attacks and web application exploits. Which THREE architectural components must be incorporated into this design? (Choose THREE)

A security architect is designing a defensible network architecture for a new campus. The architect must implement controls that limit the spread of malware from an infected endpoint to other endpoints on the same VLAN. Which TWO actions should be included in the design? (Choose two.)

GSEC Defensible Network Architecture — All Questions With Answers

An organization is hardening its internal corporate network architecture to prevent unauthorized hosts from connecting to switch ports in common areas and conference rooms. Which TWO configurations should the network engineering team implement to achieve this security objective? (Choose TWO)

A security architect is hardening an organization's network infrastructure against reconnaissance and layer-2 attacks. Which TWO actions should the engineering team take to mitigate common switch-based vulnerabilities? (Choose TWO)

Refer to the exhibit. A network administrator configured port security on a switch interface to protect against unauthorized device connections. Based on the provided configuration snippet, what action will the switch take if a third device with an unknown MAC address connects to this port?

Exhibit

A security team is designing a resilient perimeter architecture to protect internal services from distributed denial of service attacks and web application exploits. Which THREE architectural components must be incorporated into this design? (Choose THREE)

A security architect is designing a defensible network architecture for a new campus. The architect must implement controls that limit the spread of malware from an infected endpoint to other endpoints on the same VLAN. Which TWO actions should be included in the design? (Choose two.)