2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is reviewing NetFlow records to identify the source IP of a malicious scan. The traffic passed through a firewall that performs PAT (Port Address Translation) and also has an ACL that permits only HTTP and HTTPS traffic. The analyst sees many flows from the firewall's public IP to various internal servers on port 443. What is the primary challenge in correlating these flows to the original internal host?

   • APAT replaces the original source IP and port with the firewall's public IP and a translated port, so the internal host's identity is hidden in the flow records.
   • BEncryption on the HTTPS traffic prevents the flow records from containing the source IP.
   • CThe ACL is configured to permit only HTTP, so the HTTPS flows are not legitimate and should be ignored.
   • DThe ACL blocks the NetFlow export, so the analyst only sees partial flow data.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is monitoring network traffic for signs of data exfiltration. The analyst notices a workstation that is sending a steady stream of small packets to a known Tor relay. The analyst wants to determine what data is being sent. What is the primary obstacle to seeing the actual data being exfiltrated?

   • AThe packets are too small to be captured by the monitoring tool, so the analyst misses the data.
   • BThe workstation is using a VPN in addition to Tor, so the analyst only sees the VPN tunnel, not the Tor traffic.
   • CThe Tor relay is using a load balancer, so the analyst cannot correlate the flows to the same session.
   • DTor encrypts the data in multiple layers, so the analyst can only see the destination relay's IP, not the final destination or content.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security operations center (SOC) uses an intrusion detection system (IDS) to monitor traffic to a web application. The web application recently enabled TLS for all client connections. The SOC analysts notice that the IDS is no longer generating alerts for SQL injection attempts that were previously detected. What is the most likely reason for the loss of visibility?

   • ATLS encrypts the HTTP payload, so the IDS cannot inspect the application-layer content for SQL injection patterns.
   • BThe ACL on the firewall is blocking the IDS from seeing the TLS traffic.
   • CThe web application's load balancer is terminating TLS and the IDS is monitoring the encrypted side.
   • DThe IDS is not configured to decode TLS, so it drops all encrypted traffic.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is investigating a potential data exfiltration incident involving a peer-to-peer (P2P) application. The analyst has network flow data showing many connections to various IPs on random ports. The P2P application uses encryption and obfuscation. The analyst also has endpoint logs from the user's workstation. Which approach would be most effective in determining whether data was exfiltrated?

   • AUse deep packet inspection to decode the P2P protocol and read the file contents.
   • BAnalyze the network flow data to identify the destination IPs and then contact those ISPs.
   • CCorrelate the endpoint logs with the network flow data to identify which files were accessed and when they were sent.
   • DBlock the P2P application at the firewall to prevent further exfiltration.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security analyst is investigating a user who is suspected of using Tor to access illegal content. The analyst has access to the corporate proxy logs, which show that the user's workstation made a connection to a Tor relay on port 9001. The analyst also has network flow data from the firewall. The user's traffic to the Tor network is encrypted. What is the most effective way to determine what the user accessed while using Tor?

   • ADecrypt the Tor traffic by obtaining the user's Tor private key.
   • BBlock Tor traffic at the firewall to prevent further access.
   • CCorrelate the timing of the Tor connection with other network activity and use endpoint forensics to identify Tor browser artifacts.
   • DUse the firewall logs to trace the traffic through the Tor network to the destination.
   Reveal Solution Discussion Select an answer first