1.2 Compare Security Deployments 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of Endpoint Protection Platform (EPP) software installed on a user's laptop?

   • ATo protect the laptop from malware and other threats using a combination of prevention and detection techniques
   • BTo monitor network traffic at the perimeter for intrusion attempts
   • CTo provide a centralized platform for managing cloud resources
   • DTo encrypt all network traffic between the laptop and the internet
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is a major limitation of legacy antivirus against modern threats?

   • AIt cannot detect malware that has not been seen before and has no signature
   • BIt consumes too much CPU to run on modern hardware
   • CIt only works on Windows operating systems
   • DIt cannot be updated with new signatures
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is migrating a web application to a public cloud IaaS environment. The security team requires a network-level control that can filter traffic between the application's subnets and the internet, and also enforce allow/deny rules between the web tier and the database tier. The team wants to avoid deploying additional virtual appliances. Which control should the team configure?

   • AA web application firewall (WAF) placed in front of the web tier
   • BNetwork security groups (NSGs) applied to both subnets
   • CA host-based firewall configured on each virtual machine
   • DA VPN gateway connecting the VNet to the on-premises network
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is a common advantage of agentless security monitoring over agent-based monitoring?

   • AIt provides more detailed visibility into endpoint processes and files
   • BIt does not require software installation on each monitored device
   • CIt works even when the network is segmented and traffic is encrypted
   • DIt can block malicious processes in real time on the endpoint
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst needs to investigate a potential malware infection on a single employee's workstation. The analyst requires visibility into running processes, registry modifications, and file system changes on that specific device. Which approach provides the deepest visibility into the endpoint's internal state?

   • AA network-based intrusion detection system (NIDS)
   • BAn agentless network monitoring solution analyzing the workstation's traffic
   • CA SIEM that aggregates logs from the workstation
   • DAn agent-based EDR solution installed on the workstation
   Reveal Solution Discussion Select an answer first