1.7 Detect and Mitigate Common Types of Attacks CCIE-SECURITY Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard · select all that apply

   A security analyst is investigating a potential botnet infection on a corporate workstation. The workstation is making periodic HTTPS connections to a known malicious domain. The analyst wants to confirm the botnet and disrupt its C2 channel without completely isolating the workstation. Select all that apply.

   • ABlock the malicious domain at the firewall
   • BDisable the workstation's network interface
   • CSinkhole the malicious domain by redirecting its DNS resolution to a controlled server
   • DPerform a memory dump of the workstation to identify the botnet process
   • ERun a full antivirus scan
   Check answers Discussion Select an answer first
2. 47expert · hard

   A company is experiencing a DDoS attack that is targeting their DNS infrastructure. The attack is a mix of volumetric UDP floods and DNS amplification attacks. The company has a limited budget and needs to maintain DNS availability for legitimate users. Which mitigation strategy provides the BEST balance of cost and effectiveness?

   • ABlackhole the DNS server's IP address
   • BUse a cloud-based DDoS scrubbing service
   • CDeploy more DNS servers to handle the load
   • DImplement rate limiting on the DNS server for all queries
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security engineer is configuring an IPS to detect and prevent evasion techniques. The engineer notices that the IPS is missing attacks that use overlapping IP fragments, where the second fragment overwrites part of the first. The IPS is currently set to reassemble fragments in the order they arrive. What is the BEST configuration to prevent this evasion?

   • AConfigure the IPS to drop packets with overlapping fragments
   • BEnable TCP stream reassembly
   • CDisable fragment inspection
   • DSet the IPS to reassemble fragments in reverse order
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A network administrator is troubleshooting a MITM attack on a network. The administrator suspects ARP poisoning is occurring. The switches support DHCP snooping and Dynamic ARP Inspection (DAI). However, DAI is not enabled on all VLANs. Which additional measure would be MOST effective in detecting ARP poisoning on VLANs where DAI is not enabled?

   • AEnable port security on all switch ports
   • BUse an IDS to monitor ARP traffic for anomalies
   • CDisable ARP on the network
   • DConfigure static ARP entries on all hosts
   Reveal Solution Discussion Select an answer first
6. 50expert · hard · select all that apply

   A security team is analyzing network traffic and suspects that a botnet is using a peer-to-peer (P2P) C2 model, where bots communicate with each other rather than a central server. The team wants to disrupt the botnet. Which actions would be effective in disrupting a P2P botnet? Select all that apply.

   • AIsolate infected hosts from the network
   • BUse deep packet inspection to identify P2P traffic and block it
   • CIdentify and block known P2P C2 ports
   • DBlock all traffic to known botnet domains
   • ESinkhole the botnet's peer list by poisoning the P2P network
   Check answers Discussion Select an answer first