2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is investigating a data exfiltration incident. The logs show that a workstation established a connection to a known Tor relay. The analyst wants to determine what data was sent. The traffic between the workstation and the Tor network is encrypted and routed through multiple relays. What is the primary limitation the analyst faces in seeing the exfiltrated data?

   • AThe analyst can see the data by using the Tor exit node's logs.
   • BThe analyst can reconstruct the data by correlating traffic across all Tor relays.
   • CTor encrypts the payload and routes it through multiple relays, so the analyst cannot see the original data without the decryption keys or endpoint access.
   • DThe analyst can see the data by inspecting the traffic at the workstation's network egress because Tor does not encrypt the payload.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is tasked with detecting malware command-and-control (C2) traffic that is known to use DNS tunneling. The analyst has visibility into the corporate DNS server logs and the network traffic at the internet egress. The C2 traffic is encapsulated in DNS queries and responses. The analyst also knows that the C2 traffic is encrypted with a custom algorithm. Which approach would provide the best visibility into the C2 traffic?

   • AAnalyze DNS logs for unusual query patterns and sizes, and inspect the DNS payload for encoded data.
   • BDecrypt the DNS traffic using the custom encryption algorithm.
   • CUse a network IDS to inspect the DNS payload for known malware signatures.
   • DBlock all DNS traffic to prevent the tunneling.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network engineer is troubleshooting why a network analyzer is not showing the expected HTTP traffic between two hosts. The traffic is encapsulated in a VXLAN tunnel. The analyzer is connected to a SPAN port on the same switch as the source host. What is the most likely reason the analyzer does not see the HTTP payload?

   • AThe analyzer does not support UDP, so it cannot parse the VXLAN packets.
   • BVXLAN encapsulation adds an outer UDP header and VXLAN header, hiding the inner Ethernet frame and its HTTP payload.
   • CThe HTTP traffic is encrypted, so the analyzer cannot see the payload.
   • DThe SPAN port is not configured to capture VXLAN traffic because it is a multicast protocol.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is monitoring traffic on a network that uses GRE tunnels between remote sites. The analyst notices that the IDS is not generating alerts for malware traffic that is known to be active on the internal network. The traffic is encapsulated in GRE. What is the most likely reason the IDS is missing the malicious payload?

   • AThe IDS is configured to ignore GRE traffic because it is considered trusted.
   • BThe IDS cannot inspect the inner payload of GRE-encapsulated packets unless it is configured to decapsulate or reassemble the tunnel traffic.
   • CThe IDS is not receiving traffic because the GRE tunnel is encrypted and the IDS lacks the decryption key.
   • DThe IDS is only monitoring the outer IP header and cannot see the inner IP header because of NAT.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is deploying a new intrusion prevention system (IPS) inline on the network. The network carries both encrypted and unencrypted traffic. The team wants to ensure the IPS can inspect all traffic for threats. What should the team do to achieve visibility into the encrypted traffic?

   • AConfigure the IPS to block all encrypted traffic.
   • BPlace the IPS on a SPAN port to see the encrypted traffic.
   • CDeploy a TLS-decrypting proxy or use SSL inspection on the IPS to decrypt and inspect the traffic.
   • DUse an ACL to allow only unencrypted traffic to the IPS.
   Reveal Solution Discussion Select an answer first