1.9 Identify Potential Data Loss from Traffic Profiles 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which technique can be used to exfiltrate data by encoding it in a protocol that is typically allowed through firewalls?

   • AMAC address spoofing
   • BARP poisoning
   • CVLAN hopping
   • DDNS tunneling
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is setting up traffic profiling for a small company. The analyst wants to identify potential data loss by detecting deviations from normal behavior. Which step is essential for this process?

   • AEstablish a baseline of normal network traffic patterns
   • BMonitor only inbound traffic for signs of intrusion
   • CDisable all outbound traffic to prevent data loss
   • DReview firewall logs once a month for unusual activity
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing traffic logs and notices that a user's workstation has been sending data to an external IP address that is not in the organization's approved list. The total volume is 2 GB over 10 minutes, which is significantly higher than the user's normal outbound traffic. Which technique should the analyst use to determine if this is a data loss event?

   • AReview the user's email sent items for large attachments
   • BCompare the traffic volume and destination against the user's historical baseline and the organization's approved external IP list
   • CRun an antivirus scan on the workstation
   • DCheck the user's web browsing history for the day
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst sees a spike in outbound SMTP traffic from a single user's workstation to an external email server. The user's job involves sending large attachments to clients. The analyst checks the baseline and finds that the user regularly sends emails with attachments up to 20 MB, but today's spike is 500 MB in one hour. What is the most appropriate conclusion?

   • AThe spike warrants further investigation to determine if the data sent was authorized.
   • BThe spike is likely a false positive because the user regularly sends attachments.
   • CThe spike should be ignored because email is a legitimate business tool.
   • DThe spike is a confirmed data exfiltration incident because it exceeds the baseline.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization wants to implement traffic profiling to detect data loss. The security team has collected NetFlow data for the past six months. Which step is most important to establish a reliable baseline?

   • AExclude all encrypted traffic from the baseline.
   • BFocus only on outbound traffic to external destinations.
   • CInclude data from all times of day and days of the week.
   • DUse only the most recent week of data to reflect current behavior.
   Reveal Solution Discussion Select an answer first