5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security analyst is profiling a critical database server (in the critical asset address space) and notices that it is receiving traffic on TCP port 1433 from an unusual source IP. The total throughput is low, but the session duration is very short and repeated. The database server is not supposed to be accessed from that source IP. What is the most likely explanation?

   • AA DDoS attack that is saturating the network
   • BA misconfigured application that is trying to connect to the database
   • CA legitimate backup process that uses a different source IP
   • DA port scan or probing activity targeting the database server
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization is implementing network monitoring and wants to focus on its most valuable systems. The security team has identified a set of servers that contain sensitive customer data. How should the team define the critical asset address space for the monitoring system?

   • AAs the IP addresses of the IT administrators' workstations
   • BAs the IP subnets that contain the sensitive servers
   • CAs the IP addresses of all network devices
   • DAs the entire public IP range of the organization
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A network analyst is reviewing traffic for a database server that is accessed by both internal applications and external partners. The analyst notices that sessions from one partner IP have an average duration of 45 minutes, while all other external partners have an average duration of 5 minutes. The total throughput per session is similar. What should the analyst do?

   • AIgnore the anomaly because throughput is normal
   • BBlock the partner's IP address
   • CIncrease the logging level for all partner traffic
   • DInvestigate the partner's sessions to determine if the long duration is legitimate
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is tuning an IDS for a critical application server. The server uses port 443 for HTTPS and port 8443 for a management interface. The analyst wants to reduce false positives while ensuring that attacks against the management interface are detected. Which approach is BEST?

   • AMonitor only the critical asset address space, not the ports
   • BDisable alerts for port 8443 to reduce noise
   • CCreate separate profiles for port 443 and port 8443, with stricter alerts for 8443
   • DApply the same profile to both ports
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization is defining its critical asset address space for network profiling. The security team wants to prioritize monitoring for a group of servers that handle payment transactions. Which address space should be designated as the critical asset address space?

   • AThe entire corporate network range
   • BThe public IP addresses of the organization's internet gateway
   • CThe subnet containing the payment transaction servers
   • DThe IP addresses of all client workstations
   Reveal Solution Discussion Select an answer first