1.7 Detect and Mitigate Common Types of Attacks CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is deploying a new wireless network for guests. The security team is concerned about man-in-the-middle attacks, particularly SSL stripping and ARP poisoning. The wireless network is isolated from the corporate network, but guests need internet access. What is the most effective way to mitigate these attacks?

   • AUse MAC address filtering to allow only known devices
   • BDeploy a VPN for all guest traffic
   • CEnable client isolation on the wireless access points
   • DUse a captive portal with HTTPS and enforce HSTS on the guest network
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security operations center (SOC) is analyzing a botnet infection. The botnet uses a peer-to-peer (P2P) communication model, and the infected hosts are also generating DNS queries for a domain that is used as a fallback C2. The SOC wants to disrupt the botnet without losing visibility. Which strategy is most effective?

   • ABlock all traffic to the fallback C2 IP address
   • BDisconnect all infected hosts from the network
   • CDeploy a firewall rule to drop all outbound traffic from infected hosts
   • DSinkhole the fallback C2 domain and use traffic analysis to map the P2P network
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is experiencing a DDoS attack that is a mix of UDP flood and fragmented ICMP packets. The attack is saturating the internet link. The company has a scrubbing service available from their ISP. What is the best approach to mitigate this attack?

   • ARoute traffic through the ISP's scrubbing center to filter attack traffic
   • BConfigure the firewall to drop all ICMP and UDP traffic
   • CEnable BGP RTBH (Remotely Triggered Blackhole) for the victim's IP prefix
   • DIncrease bandwidth and hope the attack subsides
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is reviewing IDS logs and notices that an attacker is sending HTTP requests with the payload split across multiple packets and using chunked transfer encoding. The IDS is configured to reassemble TCP streams but is still missing the attack. What is the most likely reason?

   • AThe IDS is not decoding chunked transfer encoding, so the reassembled stream is not normalized
   • BThe attacker is using SSL encryption
   • CThe IDS signature is not enabled
   • DThe IDS is not inspecting the correct interface
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A network administrator is configuring a new DMZ for public-facing servers. The servers need to be accessible from the internet, but the administrator wants to prevent IP spoofing and DNS spoofing. Which set of measures should be implemented?

   • ADeploy an IPS with deep packet inspection
   • BUse a stateful firewall with strict rules
   • CEnable port security on the DMZ switches
   • DImplement ingress/egress filtering on the DMZ router and DNSSEC for the DNS servers
   Reveal Solution Discussion Select an answer first