1.9 Identify Potential Data Loss from Traffic Profiles 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company's security team has a baseline that shows the marketing department typically uploads a total of 200 MB per day to a cloud file-sharing service. Today, a single marketing user uploaded 1.5 GB in one hour to the same service. The user's manager confirms the user was working on a large video project. What should the analyst do next?

   • ATreat the upload as a confirmed data exfiltration incident and escalate to management.
   • BCompare the file size and destination to the user's historical usage and the project requirements.
   • CBlock the cloud file-sharing service for all users to prevent further data loss.
   • DIgnore the anomaly because the manager provided a valid explanation.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of traffic profiling in network security monitoring?

   • ATo establish a baseline of normal network behavior for comparison
   • BTo block all traffic that does not match a known signature
   • CTo encrypt all sensitive data in transit
   • DTo replace firewall rules with dynamic traffic policies
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What does correlating traffic anomalies with data loss events help an analyst do?

   • AEncrypt all sensitive data
   • BAutomatically block the attacker
   • CConfirm or refute that a data loss incident occurred
   • DReplace the firewall rules
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which traffic pattern is most indicative of potential data exfiltration?

   • AA large, sustained outbound data transfer to an external host
   • BA brief increase in inbound web traffic
   • CA single failed login attempt on a server
   • DA regular backup job running at night
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is reviewing network traffic and notices that a user is sending large files to a personal webmail account via HTTPS. The organization's policy prohibits sending sensitive data to personal email. Which data loss vector is being used?

   • AEmail exfiltration
   • BFTP file transfer
   • CDNS tunneling
   • DWeb upload to a cloud storage service
   Reveal Solution Discussion Select an answer first