2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which statement accurately describes how an access control list (ACL) can impact data visibility for security monitoring?

   • AAn ACL can prevent certain traffic from being forwarded, so that traffic is not visible to monitoring tools that observe forwarded traffic.
   • BAn ACL can change the source IP address of packets to hide the origin from monitoring tools.
   • CAn ACL can duplicate all permitted traffic to a monitoring port for analysis.
   • DAn ACL can hide the payload of permitted traffic from monitoring tools.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security analyst is setting up a network tap to monitor traffic between two departments. The network team has implemented an ACL on the switch that permits only HTTP and HTTPS traffic between the departments. The analyst wants to see all traffic, including other protocols. What is the impact of the ACL on the analyst's visibility?

   • AThe ACL filters the traffic before it reaches the tap, so the analyst will only see HTTP and HTTPS traffic.
   • BThe ACL does not affect the tap because taps copy all traffic regardless of ACLs.
   • CThe ACL only affects traffic to the internet, not between departments.
   • DThe ACL encrypts the traffic, so the analyst cannot see the payload.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security analyst is troubleshooting why the intrusion detection system (IDS) is not seeing traffic from a specific internal subnet. The network team confirms that the subnet is active and generating traffic. The IDS is connected to a SPAN port on the core switch, and an ACL is applied inbound on the core switch's uplink interface. What is the most likely reason the IDS is missing this traffic?

   • AThe ACL is filtering the traffic before it reaches the SPAN port, so the IDS never sees the packets.
   • BThe ACL is applied in the wrong direction, so it only filters traffic leaving the subnet, not entering it.
   • CThe SPAN port is only copying traffic that is destined to the core switch's management IP address.
   • DThe IDS is configured to ignore traffic that is encrypted, so it discards the packets after capture.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security analyst is investigating a user who is suspected of accessing illegal content through the Tor network. The analyst has full packet captures from the user's workstation to the first Tor relay. What information can the analyst definitively determine from these captures?

   • AThe analyst can decrypt the Tor traffic by using the first relay's private key.
   • BThe analyst can determine the content of the traffic because Tor does not encrypt the payload.
   • CThe analyst can see the final destination website because Tor does not encrypt the destination IP.
   • DThe user is connecting to the Tor network, but the analyst cannot see the final destination or the content of the traffic.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Why does peer-to-peer (P2P) networking complicate network monitoring compared to traditional client-server traffic?

   • AP2P traffic is always encrypted, so monitoring tools cannot read the payload.
   • BP2P traffic uses non-standard ports that are blocked by most firewalls.
   • CP2P traffic is distributed among many peers, so there is no single point of aggregation for monitoring.
   • DP2P traffic uses a single central server, making it easier to monitor.
   Reveal Solution Discussion Select an answer first