2.15 Recommend Tuning or Adapting Devices and Software Across Rules, Filters, and Policies 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network monitoring system has been generating alerts for a sudden increase in DNS traffic from a specific workstation. The baseline for that workstation shows that DNS traffic is typically low. The analyst investigates and finds that the workstation is running a legitimate backup application that uses DNS to resolve the backup server's hostname frequently. What should the analyst recommend?

   • ACreate a rule to suppress all DNS alerts for the workstation.
   • BBlock the workstation's DNS traffic to prevent potential data exfiltration.
   • CUpdate the baseline for the workstation to reflect the new DNS usage pattern and adjust the alert threshold.
   • DIncrease the alert severity for DNS traffic from the workstation.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security administrator is reviewing the firewall rule base and finds that a rule allowing legacy FTP traffic has not been used in six months. The company has migrated to SFTP for all file transfers. The administrator wants to maintain a clean rule base and reduce the attack surface. What should the administrator do?

   • ADisable the FTP rule and monitor for any legitimate FTP traffic that might be blocked.
   • BDelete the FTP rule immediately because it is no longer needed.
   • CModify the FTP rule to allow only specific IP addresses to reduce risk.
   • DKeep the FTP rule in case it is needed in the future.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A university's network team observes that a new research collaboration tool generates large amounts of encrypted traffic to a specific cloud provider. The current web filter blocks all traffic to that provider's IP range, causing user complaints. Threat intelligence indicates that the provider's IP range is also used by a known malware family. The team wants to allow the legitimate tool while still blocking malicious activity. What should they do?

   • ADisable the web filter entirely for the research department's subnet.
   • BAllow all traffic to the cloud provider's IP range to avoid disrupting research.
   • CCreate a filter rule that allows traffic to the specific domain and port used by the research tool, while keeping the IP-range block for other traffic.
   • DAdd a second block rule for the malware family's specific command-and-control domains.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which scenario best illustrates adapting filters based on threat intelligence?

   • AChanging the administrative password on the firewall
   • BReviewing firewall logs to identify performance bottlenecks
   • CBacking up the firewall configuration
   • DUpdating a firewall rule to block traffic from a newly identified malicious IP address
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is tuning an intrusion detection system (IDS) that monitors a data center network. The analyst observes that a particular signature for 'ET TROJAN Win32/Agent Tesla Checkin' is firing on traffic from a legitimate internal server that performs web requests to a known-good external service. The signature is known to have a high false-positive rate in environments that use certain web proxies. What should the analyst do to reduce false positives while maintaining detection for other hosts?

   • AMove the internal server to a different network segment and apply the signature only to that segment.
   • BIncrease the IDS sensitivity threshold to reduce the number of alerts for all signatures.
   • CCreate a suppression rule for the signature on the specific internal server's IP address.
   • DDisable the signature globally because it is too noisy.
   Reveal Solution Discussion Select an answer first