4.1 Map the Provided Events to Source Technologies 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security analyst is reviewing an alert that contains the message "Signature SID 2024211: ET MALWARE Possible Metasploit Payload" along with source and destination IP addresses. Which technology most likely generated this event?

   • AIntrusion detection system (IDS)
   • BFirewall
   • CProxy server
   • DAntivirus software
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing logs from a network monitoring tool. The logs show entries like 'alert tcp any any -> any 80 (msg:"SQL Injection Attempt"; content:"union select";)' and also 'flow record export' entries with byte counts. Which two source technologies are most likely represented in these logs?

   • AAntivirus and network application control
   • BIDS/IPS and NetFlow
   • CFirewall and proxy
   • DIDS/IPS and firewall
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An organization is deploying a defense-in-depth monitoring stack. They need to detect known exploit signatures, enforce allow/deny policies, and identify long-lived data transfers. They have limited budget and want to minimize false positives. Which combination of source technologies should they deploy?

   • AProxy, antivirus, and NetFlow
   • BFirewall, proxy, and IDS
   • CIDS, firewall, and NetFlow
   • DNetFlow, antivirus, and proxy
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A record contains the following fields: source IP, destination IP, source port, destination port, protocol, and number of bytes transferred. Which technology is the most likely source of this record?

   • AProxy server
   • BNetFlow collector
   • CFirewall
   • DAntivirus software
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which event is most likely generated by a flow-based monitoring technology such as NetFlow?

   • AUser 'alice' requested http://example.com and was blocked by category 'Malware'
   • BFile 'malware.exe' was quarantined
   • CFlow record: Src=10.0.0.1, Dst=10.0.0.2, SrcPort=1234, DstPort=80, Protocol=TCP, Bytes=1024
   • DAlert: ET MALWARE Possible C2 Beacon from 10.0.0.1 to 10.0.0.2
   Reveal Solution Discussion Select an answer first