2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a network that uses Port Address Translation (PAT), how does PAT affect the visibility of internal host connections in monitored traffic?

   • APAT encrypts the source port, so the internal host's port number is not visible.
   • BPAT adds a new layer of encapsulation, so the internal host's IP address is hidden in an inner header.
   • CPAT duplicates the internal host's IP address in the packet payload, so the original address is still visible.
   • DPAT hides the internal host's IP address by replacing it with the router's public IP address and a unique source port.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is configuring a network-based intrusion detection system (IDS) to monitor traffic between two internal servers. The servers communicate using TLS encryption. The analyst wants to detect a specific application-layer attack that is known to be sent in the clear. What is the most effective approach to gain visibility into the application-layer payload?

   • AUse NetFlow to capture the full payload of the encrypted traffic for offline analysis.
   • BRely on the IDS's ability to inspect encrypted traffic by analyzing the TLS handshake metadata.
   • CConfigure the IDS to decrypt the TLS traffic by providing the server's private key or using a proxy with SSL inspection.
   • DDisable TLS on the servers so the traffic is sent in the clear, allowing the IDS to inspect it.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is troubleshooting why a network-based intrusion detection system (IDS) is not seeing HTTP requests from a specific user subnet to a web server. The network team recently implemented an access control list (ACL) on the router between the user subnet and the server, and also introduced a load balancer in front of the web server. The IDS is connected to a SPAN port on the switch that connects to the web server. Which two factors most directly explain the missing visibility?

   • AThe load balancer encrypts the traffic, and the ACL is dropping the IDS's monitoring traffic.
   • BThe SPAN port is not capturing traffic because the ACL is applied to the SPAN port itself.
   • CThe load balancer is performing NAT, which hides the destination IP, and the ACL is blocking the IDS's management traffic.
   • DThe ACL is blocking the traffic before it reaches the SPAN port, and the load balancer changes the source IP of the traffic.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is monitoring traffic for a remote user who connects to the corporate network via a VPN. The analyst wants to inspect the traffic for malware signatures. The VPN traffic is encapsulated in IPsec. What is the primary limitation the analyst faces when trying to inspect the VPN traffic?

   • AThe VPN traffic is fragmented, so the analyst cannot reassemble the packets to inspect the payload.
   • BThe VPN traffic is routed through a load balancer, so the analyst cannot correlate the flows.
   • CThe VPN traffic uses a different protocol, so the analyst's monitoring tool does not support it.
   • DThe IPsec encapsulation hides the inner packet's payload, so the analyst cannot see the application-layer data without decapsulation.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is monitoring traffic on a network that uses IPsec VPN tunnels for remote access. The analyst notices that the IDS is not detecting malware that is known to be spreading through the VPN traffic. What is the most likely reason for the lack of detection?

   • AThe VPN tunnel uses GRE encapsulation, which hides the inner IP header.
   • BThe IDS is not configured to monitor the VPN tunnel interface.
   • CThe IDS is placed on the wrong segment of the network.
   • DIPsec encrypts the payload, so the IDS cannot inspect the inner packets for malware signatures.
   Reveal Solution Discussion Select an answer first