5.1 Define Key Security Concepts (threats, Vulnerabilities, Exploits, and Mitigation Techniques) 200-301 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is experiencing intermittent network outages. Analysis shows that the company's public web server is receiving a high volume of UDP traffic on port 53 from many different sources, and the server's CPU is saturated. The traffic appears to be DNS queries. Which type of attack is this, and which mitigation is MOST effective?

   • APhishing attack; implement email filtering and user training
   • BDNS amplification DDoS attack; deploy rate limiting and enable response rate limiting (RRL) on the DNS server
   • CMan-in-the-middle attack; deploy SSL/TLS inspection
   • DMalware infection; run antivirus scans on the server
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A network administrator is reviewing security for a remote-access VPN. The VPN appliance has a default administrative account with a well-known password, and the administrator notices failed login attempts from the internet. Which vulnerability is being exploited, and which mitigation should be applied first?

   • AMisconfiguration; disable the VPN service
   • BSoftware flaw; apply the latest firmware patch
   • CPhishing attack; implement email filtering
   • DWeak password vulnerability; change the default credentials and enforce strong password policies
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company wants to reduce the risk of employees inadvertently installing malware by visiting malicious websites. The employees need to access a wide range of legitimate websites for research. Which mitigation is most appropriate?

   • ADisable the employees' local administrator privileges
   • BBlock all internet access except for a small whitelist of approved sites
   • CImplement a web proxy with URL filtering and reputation-based blocking
   • DIncrease the frequency of full disk antivirus scans
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A network administrator notices that a router has an open Telnet service enabled on the management interface. An attacker uses a password-cracking tool to gain access. Which type of vulnerability is being exploited, and which mitigation would be MOST effective?

   • APhishing vulnerability; implement email filtering and user training
   • BWeak password vulnerability; enforce strong password policies and use SSH instead of Telnet
   • CSoftware flaw vulnerability; apply the latest firmware update
   • DMisconfiguration vulnerability; disable Telnet and use SSH with strong passwords
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company's network is experiencing a slow but steady increase in traffic from a botnet. The traffic is spread across many protocols and ports, making it difficult to block. The company wants to minimize the impact without causing downtime. Which approach is BEST?

   • ABlock all traffic from the botnet's source IP addresses
   • BShut down the internet connection until the attack stops
   • CIgnore the traffic because it is not causing immediate outages
   • DUse anomaly-based detection and rate limiting to identify and throttle suspicious traffic patterns
   Reveal Solution Discussion Select an answer first