5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a potential data exfiltration from a corporate network. The analyst has NetFlow data showing that a workstation has been sending data to an external IP address on TCP port 443 for the past 3 hours. The total throughput is 2 Mbps, and the session duration is continuous. The workstation is not a web server and has no known business need to maintain a persistent HTTPS connection. Which action is most appropriate?

   • ABlock the destination IP immediately without further analysis
   • BIgnore the traffic because HTTPS is encrypted and cannot be inspected
   • CTreat this as a potential exfiltration and investigate the destination IP and the workstation's processes
   • DAssume it is a software update and continue monitoring
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is session duration important in network profiling?

   • AIt helps identify the operating system of the source device
   • BIt determines the physical location of the server
   • CIt calculates the total bandwidth consumed by the session
   • DIt helps distinguish between normal and anomalous session behavior
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What does 'critical asset address space' refer to in network profiling?

   • AThe total number of IP addresses available in the entire organization
   • BThe IP addresses used by external customers
   • CThe IP address ranges assigned to servers and systems that are essential to business operations
   • DThe range of MAC addresses for network interfaces
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is reviewing network flows for a critical server that is accessed by employees and external partners. The analyst notices that a single external IP has sessions that last 10 times longer than the average for other external IPs, and the total throughput is also higher. What is the MOST appropriate response?

   • AIncrease the logging level for all external traffic
   • BBlock the external IP immediately
   • CIgnore the anomaly because the IP is external and may have different usage patterns
   • DInvestigate the external IP's activity to determine if it is legitimate
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is profiling normal behavior for a remote-access VPN. The analyst wants to detect compromised accounts that may be used for long, unusual sessions. Which approach would be MOST effective?

   • AFocus on the ports used by the VPN protocol
   • BBlock all sessions that last longer than 8 hours
   • CMonitor only the total throughput of the VPN gateway
   • DEstablish a baseline of typical session durations and alert on sessions that are significantly longer
   Reveal Solution Discussion Select an answer first