2.15 Recommend Tuning or Adapting Devices and Software Across Rules, Filters, and Policies 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network administrator is reviewing the firewall rule base and finds that a rule allowing inbound RDP from the internet to a specific server has not matched any traffic in the past 12 months. The server was decommissioned six months ago, but the rule remains. What should the administrator do with this rule?

   • ADisable the rule temporarily and re-enable it if needed.
   • BLeave the rule in place in case the server is ever re-provisioned.
   • CRemove the rule and document the change in the change management system.
   • DModify the rule to log all traffic that attempts to reach the decommissioned server.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's web application firewall (WAF) is blocking requests that contain the string 'union select' in the query string. The development team recently deployed a new feature that uses the literal phrase 'union select' as a search term. Legitimate users are now being blocked. The security team has confirmed that no actual SQL injection attempts have been observed in the last 30 days. What should the security team do to maintain protection while allowing the new feature to function?

   • ARemove the 'union select' rule from the WAF policy entirely.
   • BIncrease the WAF inspection depth to look for more complex injection patterns.
   • CModify the WAF rule to inspect only the 'sql' parameter instead of the entire query string.
   • DCreate a WAF exception for all requests containing the phrase 'union select'.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A network analyst is reviewing the firewall logs and notices that the volume of outbound traffic to a cloud storage provider has increased significantly compared to the baseline. The increase is consistent with a new backup solution that was recently deployed. The analyst wants to ensure that the firewall is not blocking the backup traffic. What should the analyst do?

   • ACompare the current traffic patterns to the baseline and verify that the firewall rules allow the backup traffic.
   • BImmediately block the cloud storage provider to prevent potential data exfiltration.
   • CDisable the firewall's outbound filtering to ensure the backup traffic is not blocked.
   • DIncrease the firewall's logging level to capture more details about the traffic.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of establishing a traffic baseline in a security monitoring environment?

   • ATo provide a reference for identifying abnormal behavior that may require tuning
   • BTo ensure the network is always running at maximum capacity
   • CTo replace the need for security policies
   • DTo satisfy regulatory compliance requirements
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security analyst compares current network traffic to a baseline and notices a significant increase in DNS queries. What is the most appropriate next step?

   • AIgnore the increase because baselines are not reliable
   • BInvestigate the cause of the increase before making any rule changes
   • CIncrease the logging level for DNS traffic
   • DImmediately block all DNS traffic
   Reveal Solution Discussion Select an answer first