A security analyst is investigating a series of compromised hosts that are sending outbound connections to the same IP address on port 443 at regular intervals. The traffic is encrypted and appears to be web traffic. What is the most likely explanation, and what action should be taken?

The hosts are using a peer-to-peer botnet; block all outbound traffic

The hosts are performing DNS tunneling; enable DNSSEC

The hosts are infected with ransomware; disconnect them from the network

The hosts are part of a botnet using a centralized C2 channel; sinkhole the C2 domain

A web server is experiencing intermittent slowdowns. The logs show many incomplete TCP handshakes from a single source IP, with the server sending SYN-ACKs but never receiving the final ACK. This is consuming server resources. What type of attack is this, and what is the best mitigation?

SYN flood; enable SYN cookies on the server

UDP flood; enable rate limiting on the firewall

HTTP flood; deploy a web application firewall

An attacker is sending HTTP requests to a web server with the payload encoded in UTF-16 and using multiple slashes in the URL path. The intrusion detection system (IDS) is not generating alerts. Which evasion technique is being used, and what should be configured to detect it?

Fragmentation; enable TCP reassembly

Obfuscation; enable HTTP normalization on the IDS

Spoofing; enable IP source verification

A network administrator is concerned about ARP spoofing on the access layer. The switches support DHCP snooping and Dynamic ARP Inspection (DAI). What is the correct configuration to prevent ARP spoofing?

Enable IP source guard on all ports

Enable DHCP snooping and DAI on all access ports, with DAI validating IP-to-MAC bindings

Configure static ARP entries on all hosts

Enable port security with sticky MAC addresses

A security engineer is configuring a remote access VPN for employees. The goal is to prevent session hijacking and man-in-the-middle attacks. Which configuration should be used?

Use SSL without client certificates

Use IPsec with mutual authentication and strong encryption

CCIE Security

Domain 1Objective 7

1.7 Detect and Mitigate Common Types of Attacks CCIE-SECURITY Practice Questions (Page 8)

Part of the 1.0 Perimeter Security and Intrusion Prevention domain, which accounts for 20% of the CCIE-SECURITY exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–1 from this objective — we provide 59 practice questions to prepare you well beyond it. (estimate)

59questions here

12free pages

10concepts

20%of the exam

Questions 36–40

36application · medium
A security analyst is investigating a series of compromised hosts that are sending outbound connections to the same IP address on port 443 at regular intervals. The traffic is encrypted and appears to be web traffic. What is the most likely explanation, and what action should be taken?
Select an answer first
37application · medium
A web server is experiencing intermittent slowdowns. The logs show many incomplete TCP handshakes from a single source IP, with the server sending SYN-ACKs but never receiving the final ACK. This is consuming server resources. What type of attack is this, and what is the best mitigation?
Select an answer first
38application · medium
An attacker is sending HTTP requests to a web server with the payload encoded in UTF-16 and using multiple slashes in the URL path. The intrusion detection system (IDS) is not generating alerts. Which evasion technique is being used, and what should be configured to detect it?
Select an answer first
39application · medium
A network administrator is concerned about ARP spoofing on the access layer. The switches support DHCP snooping and Dynamic ARP Inspection (DAI). What is the correct configuration to prevent ARP spoofing?
Select an answer first
40application · medium
A security engineer is configuring a remote access VPN for employees. The goal is to prevent session hijacking and man-in-the-middle attacks. Which configuration should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-SECURITY” is a trademark of its owner, used for identification only.