2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is planning to implement TLS inspection for all outbound HTTPS traffic. The team has a compliance requirement to inspect all traffic for malware, but also a privacy requirement to protect employee personal data. The team is considering using a TLS-intercepting proxy. Which approach balances the need for visibility with the privacy requirement?

   • AInspect only the TLS handshake metadata and not the payload.
   • BDisable TLS inspection entirely to protect employee privacy.
   • CUse a network IDS that can decrypt TLS traffic without a proxy.
   • DImplement TLS interception with a proxy that decrypts traffic, applies DLP and malware detection, and then re-encrypts it, while excluding specific categories of personal sites from inspection.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does encapsulation affect the ability of a network monitoring tool to identify the application protocol being used?

   • AEncapsulation encrypts the application protocol header, making it unreadable.
   • BEncapsulation changes the application protocol to a different one, so the original protocol is lost.
   • CEncapsulation removes the application protocol header, so it cannot be identified.
   • DEncapsulation adds an outer header, so the inner protocol details are hidden from tools that only inspect the outer header.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security analyst is trying to correlate a user's session across multiple servers in a load-balanced environment. Why is this difficult?

   • ALoad balancers use a single server for all requests, making correlation easy.
   • BLoad balancers encrypt all traffic, so the session data is not visible.
   • CLoad balancers change the source IP address of each request, so the user's identity is hidden.
   • DLoad balancers distribute requests across multiple servers, so the same user's traffic may be handled by different servers.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is monitoring a web application that is behind a load balancer. The load balancer is configured with sticky sessions and performs SNAT. The analyst is correlating web server logs with network flows to investigate a brute-force attack. What challenge does the load balancer introduce to this investigation?

   • AThe load balancer changes the destination IP, so the web server logs show the wrong server IP.
   • BThe web server logs show the load balancer's IP as the source, so the analyst cannot directly identify the attacker's IP from the logs.
   • CThe load balancer applies an ACL that blocks the analyst's monitoring traffic.
   • DThe load balancer encrypts the traffic, so the web server logs do not contain the source IP.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is investigating a series of failed login attempts against an internal application. The application is behind a load balancer that performs SNAT, and the firewall between the internet and the load balancer performs PAT. The analyst has access to the application logs, which show the source IP as the load balancer's IP, and the firewall logs, which show the translated source IP and port. The analyst also has NetFlow data from the router before the firewall. Which combination of data sources would allow the analyst to identify the original client IP for a specific failed login?

   • AUse only the NetFlow data because it contains the original client IP and the application payload.
   • BCorrelate the application log timestamp with the firewall NAT log and the NetFlow data to trace the session back to the original source IP.
   • CUse only the application logs because they contain the original client IP in the HTTP headers.
   • DUse only the firewall logs because they contain the original client IP before PAT.
   Reveal Solution Discussion Select an answer first