Threats and Mitigations CNX-001 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations center (SOC) wants to detect anomalies in network traffic that may indicate a new attack. They have a baseline of normal traffic patterns. Which technique should they use?

   • AManual review of firewall logs.
   • BPeriodic vulnerability scanning.
   • CSignature-based intrusion detection.
   • DAnomaly-based monitoring using machine learning.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization receives an email that appears to be from its CEO, urgently requesting that the finance department wire a large sum of money to a vendor. The email address is slightly different from the CEO's real address. Which type of attack is this, and what is the best mitigation?

   • ADDoS; deploy a web application firewall.
   • BMalware; install antivirus software on all endpoints.
   • CPhishing; implement email authentication (SPF, DKIM, DMARC) and train users to verify unusual requests.
   • DMan-in-the-middle; use encryption for all email communications.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company's web application has been experiencing intermittent DDoS attacks that are saturating the internet link. The security team needs a mitigation that can absorb volumetric attacks without requiring manual intervention. Which solution should they implement?

   • AIncrease the bandwidth of the internet link to accommodate the attack traffic.
   • BConfigure the firewall to drop all traffic from the attacker's IP addresses.
   • CSubscribe to a cloud-based DDoS protection service that scrubs traffic before it reaches the company's network.
   • DDeploy an on-premises intrusion prevention system (IPS) inline with the firewall.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's incident response plan is being tested. The plan includes roles, communication procedures, and recovery steps. During the test, the team discovers that the contact information for the on-call network engineer is outdated. What should be updated in the plan?

   • AThe escalation procedures and contact list.
   • BThe backup and recovery procedures.
   • CThe list of critical assets.
   • DThe incident classification criteria.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During a security incident, a company's incident response team discovers that an attacker has been exfiltrating data from a database for several weeks. The team needs to determine the scope of the breach. Which step should they take first?

   • ARestore the database from the last known good backup.
   • BIsolate the affected database server from the network.
   • CReview logs from the database server and network devices to identify the access patterns and data accessed.
   • DNotify law enforcement immediately.
   Reveal Solution Discussion Select an answer first