2.15 Recommend Tuning or Adapting Devices and Software Across Rules, Filters, and Policies 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A hospital's security team is reviewing the firewall policy after a ransomware outbreak that spread via SMBv1. The current policy allows SMBv1 traffic between internal segments for legacy medical devices. The team wants to reduce the risk of lateral movement while maintaining the functionality of those devices. What should they do?

   • ALeave the policy unchanged because the devices are critical and cannot be modified.
   • BUpgrade the legacy devices to support SMBv2 and then block SMBv1.
   • CImmediately block all SMBv1 traffic across the network to eliminate the risk.
   • DCreate a policy that restricts SMBv1 traffic to only the specific IP addresses of the legacy devices and only between the required segments.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's web application firewall (WAF) is blocking a new API endpoint that uses JSON payloads with special characters. The WAF's default rule set flags these payloads as SQL injection attempts. The API is legitimate and used by a partner integration. The company wants to allow the API traffic while still protecting against SQL injection. What should they do?

   • AChange the API to use XML instead of JSON to avoid the rule.
   • BAdd an exception rule for the specific API endpoint that disables the SQL injection rule for that path.
   • CDisable the SQL injection rule globally on the WAF.
   • DIncrease the WAF's inspection depth to better understand the payloads.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   After a security incident, a team identifies that a specific rule failed to detect the attack. What is the best way to incorporate this feedback into rule modifications?

   • ADisable the rule to avoid future false positives
   • BIncrease the rule's threshold to reduce alerts
   • CIgnore the feedback because incidents are rare
   • DUpdate the rule to cover the attack pattern observed in the incident
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial services company has historically allowed employees to access personal webmail from corporate devices. After a recent phishing incident that originated from a personal webmail account, the risk committee has decided to prohibit personal webmail access during business hours. The security team must implement this change with minimal disruption to business operations. What should the security team do?

   • ABlock all webmail domains at the firewall immediately.
   • BCreate a firewall rule that blocks known personal webmail domains only during business hours.
   • CDeploy a new intrusion prevention signature to detect webmail usage and alert on it.
   • DUpdate the acceptable use policy and rely on employee awareness training.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's email security gateway is blocking emails that contain a specific attachment file type, such as .exe, to prevent malware delivery. The human resources department regularly sends out a legitimate .exe installer for a new employee onboarding tool. The security team has verified that the installer is digitally signed and hashes match the official source. What should the security team do to allow this legitimate attachment while maintaining protection against malicious executables?

   • AChange the email security gateway to quarantine all .exe attachments for manual review.
   • BCreate an allowlist rule for the specific installer's file hash and sender domain.
   • CInstruct the HR department to rename the .exe file to .txt before sending.
   • DRemove the .exe attachment blocking rule from the email security gateway.
   Reveal Solution Discussion Select an answer first