Network Security CCISO Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company is planning to connect its headquarters and a remote branch office securely over the internet. The traffic between the two sites includes sensitive data. Which solution should be implemented?

   • AA dedicated leased line with no encryption.
   • BPort forwarding on the firewall to allow direct access to internal servers.
   • CRemote access VPN for each user at the branch office.
   • DSite-to-site VPN with IPsec between the two office firewalls.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A security analyst is reviewing network traffic and notices that an attacker is sending packets with a spoofed source IP address to a network device, causing the device to send responses to the spoofed address. The analyst suspects a smurf attack. Which mitigation is most effective?

   • AIncrease the timeout for ICMP echo requests on the network devices.
   • BConfigure the network devices to drop broadcast traffic and enable ingress filtering at the perimeter to block packets with spoofed source addresses.
   • CDisable ICMP on all network devices to prevent any ICMP-based attacks.
   • DUse a firewall to block all ICMP traffic from the internet.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the purpose of the 'containment' phase in incident response?

   • ATo restore systems to normal operation
   • BTo identify the root cause of the incident
   • CTo collect evidence for legal proceedings
   • DTo limit the damage and prevent the incident from spreading further
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security operations center (SOC) analyst is investigating an alert about a potential data exfiltration. The logs show a large amount of outbound traffic from an internal server to an external IP address on port 443. The traffic is encrypted, and the server is not known to use any external web services. What should the analyst do first?

   • ACheck the server's process list and network connections to identify which application is generating the traffic.
   • BIgnore the alert because the traffic is encrypted and cannot be inspected.
   • CBlock the external IP address at the firewall immediately.
   • DDisconnect the server from the network to contain the potential breach.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company is redesigning its network to improve security. The network currently has all servers and workstations on a single flat subnet. The security team wants to reduce the risk of lateral movement if one workstation is compromised. Which design change is most effective?

   • ADeploy an IDS on the network to detect suspicious activity between hosts.
   • BSegment the network into separate VLANs for servers, workstations, and management, and use firewalls or ACLs to control traffic between them.
   • CUse a single firewall to filter traffic between the internal network and the internet, but keep the internal network flat.
   • DPlace all servers and workstations on the same subnet but enable port security on the switches.
   Reveal Solution Discussion Select an answer first