4.1 Map the Provided Events to Source Technologies 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A security analyst sees an event that says "Application 'BitTorrent' identified on session from 10.0.0.2 to 192.168.1.5, policy action: block". Which technology is the most likely source of this event?

   • AAntivirus software
   • BProxy server
   • CNetwork application control system
   • DFirewall
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which event is most likely generated by an intrusion prevention system (IPS) rather than a firewall or proxy?

   • AURL http://example.com/malware.exe was blocked because the category 'Malware' matched
   • BConnection from 10.0.0.5 to 192.168.1.10 port 443 was denied by rule 12
   • CAttack 'EternalBlue' detected on host 10.0.0.5, action: dropped
   • DFile 'report.pdf' was quarantined because it contained a known trojan
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst is triaging an alert that shows a signature match for a known exploit against a web server. The alert includes the raw packet payload. Which source technology is the most likely origin of this alert?

   • ANetwork-based IDS
   • BNetFlow
   • CFirewall
   • DProxy server
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is reviewing logs from a single network appliance. The logs show entries like 'alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET TROJAN Possible Metasploit payload download"; flow:established,to_client; content:"|ff d8 ff e0|";)' and also entries that show 'allow' or 'deny' actions tied to specific rule IDs. The analyst needs to determine which two technologies generated these logs. Which pair of source technologies is most likely represented?

   • AWeb proxy and network application control
   • BIntrusion detection system (IDS) and NetFlow
   • CAntivirus and NetFlow
   • DIntrusion prevention system (IPS) and firewall
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which event is most likely generated by a proxy server?

   • AConnection from 10.0.0.1 to 10.0.0.2 port 80 was denied by rule 10
   • BMalware 'W32.Conficker' detected in file 'update.exe'
   • CUser 'jsmith' requested https://www.example.com and was blocked because the category 'Malware' matched
   • DAlert: ET POLICY Suspicious Inbound from 10.0.0.1 to 192.168.1.1
   Reveal Solution Discussion Select an answer first