1.9 Identify Potential Data Loss from Traffic Profiles 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which statement best describes how traffic profiling distinguishes abnormal from normal network behavior?

   • AIt inspects every packet for malware signatures
   • BIt uses machine learning to predict future attacks
   • CIt compares current traffic patterns to a historical baseline
   • DIt blocks traffic from unknown IP addresses
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is tasked with identifying potential data loss from traffic profiles. The analyst has access to NetFlow data and a baseline of normal network behavior. Which approach would be most effective in detecting a data exfiltration attempt that uses a legitimate cloud storage service?

   • ACompare current traffic volumes and destinations to the baseline to identify unusual outbound transfers.
   • BLook for any traffic to the cloud storage service and block it.
   • CFocus only on encrypted traffic to the cloud service.
   • DInspect the payload of all traffic to the cloud service.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is investigating a potential data loss incident. The analyst sees a large outbound transfer to an external IP that is not on the approved list. The transfer occurred at 2:00 AM, and the user associated with the workstation was on vacation. Which additional data would most help confirm the data loss event?

   • AThe user's login history showing no login at the time of the transfer
   • BThe company's internet usage policy
   • CThe workstation's antivirus scan results showing no malware
   • DThe user's email history showing no emails sent that day
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst notices that a workstation is sending a large amount of data to an external IP address on port 53 (DNS) during off-hours. The data is being sent in a continuous stream rather than as typical DNS queries. Which data loss vector is most likely being used?

   • AWeb upload to a cloud service
   • BEmail exfiltration
   • CDNS tunneling
   • DFTP file transfer
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the first step in analyzing traffic profiles for anomalies?

   • AEstablish a baseline of normal traffic
   • BBlock all suspicious IP addresses
   • CEncrypt all outbound traffic
   • DDisable unused protocols
   Reveal Solution Discussion Select an answer first