2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   A security analyst is examining network traffic that uses a tunneling protocol. Why might the analyst be unable to see the actual application-layer payload?

   • AThe tunneling protocol replaces the original payload with a new payload, so the original data is lost.
   • BThe tunneling protocol encrypts the entire packet, including the outer header.
   • CThe tunneling protocol compresses the original payload, making it unreadable to monitoring tools.
   • DThe tunneling protocol encapsulates the original packet inside a new packet, so the original payload is hidden within the tunnel.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst is reviewing firewall logs to identify the source of a port scan. The firewall performs PAT and has an ACL that permits only specific services. The logs show the source IP as the firewall's public IP and a high port number. What is the most likely reason the original source IP is not visible in the logs?

   • AThe port scan is coming from the firewall itself, so the source IP is the firewall's IP.
   • BThe firewall encrypts the logs, so the original IP is hidden.
   • CThe ACL is blocking the original source IP from being logged.
   • DPAT translates the original source IP and port to the firewall's public IP and a translated port, so the logs only show the translated information.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is monitoring a network where a P2P application is being used. The analyst notices that the P2P traffic is using a variety of ports and is encrypted. The analyst wants to identify which internal hosts are communicating with known malicious peers. What is the most effective approach to gain visibility into this traffic?

   • ABlock all P2P traffic at the firewall to prevent the communication.
   • BUse NetFlow to see the full payload of the P2P traffic.
   • CRely on the P2P application's logs to identify the peers.
   • DUse application-level gateway or proxy that can decrypt and identify P2P traffic, if supported.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst is configuring a network monitoring solution to detect data exfiltration. The analyst notices that the traffic between two internal servers is encrypted with TLS. The analyst wants to inspect the payload for sensitive data patterns. What is the most effective way to gain visibility into the payload?

   • AConfigure the monitoring tool to inspect the TLS handshake to determine if sensitive data is being sent.
   • BDeploy a proxy that terminates TLS and forwards the decrypted traffic to the monitoring tool.
   • CDisable TLS on the servers so the monitoring tool can see the plaintext traffic.
   • DUse NetFlow to capture the full payload of the encrypted traffic.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which statement best describes the impact of encryption on data visibility for security monitoring?

   • AEncryption hides the IP addresses of the communicating hosts.
   • BEncryption protects the confidentiality of the data but prevents monitoring tools from inspecting the payload.
   • CEncryption removes all metadata, such as source and destination ports.
   • DEncryption increases the size of packets, making them easier to analyze.
   Reveal Solution Discussion Select an answer first