5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is reviewing network flows for a critical database server. The analyst notices that a session from an internal client to the database has been active for 12 hours, while the normal session duration is under 30 minutes. What should the analyst do FIRST?

   • AInvestigate the session to determine if it is legitimate
   • BIgnore the session because session duration is not a reliable indicator
   • CBlock the client's IP address immediately
   • DChange the database password
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security analyst is profiling a critical server that is part of the critical asset address space. The analyst notices that the server is receiving traffic on TCP port 3389 from an external IP address. The total throughput is low, but the session duration is long. The server is not supposed to be accessed remotely from the internet. What is the most likely explanation?

   • AA legitimate remote administration session from a contractor
   • BA DDoS attack targeting the RDP service
   • CAn attempted or active remote desktop compromise
   • DA misconfigured firewall that is allowing RDP traffic
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is creating a baseline for a critical application server. The analyst observes that the average session duration is 5 minutes, but there are periodic sessions that last over 2 hours. What should the analyst do with these long sessions?

   • ASet the baseline to 2 hours to include all sessions
   • BInvestigate the source of the long sessions to determine if they are legitimate
   • CAutomatically block the source IPs of the long sessions
   • DIgnore the long sessions because they are outliers
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   A security analyst is prioritizing monitoring for a company's financial systems. The analyst has identified the critical asset address space as 172.16.20.0/24. Which traffic should be monitored most closely?

   • AOnly traffic from the internet to 172.16.20.0/24
   • BOnly inbound traffic to 172.16.20.0/24
   • CAll traffic to and from 172.16.20.0/24
   • DOnly traffic on port 443 to 172.16.20.0/24
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security analyst is tuning a network monitoring system for a critical database server. The server uses port 1433 for SQL traffic and port 3389 for remote desktop. The analyst wants to detect unauthorized remote desktop access while minimizing false positives for legitimate SQL traffic. Which approach is BEST?

   • AMonitor only the critical asset address space, not the ports
   • BMonitor port 3389 separately with a stricter alert threshold
   • CMonitor both ports with the same threshold
   • DDisable monitoring for port 1433 to reduce noise
   Reveal Solution Discussion Select an answer first