Network Security CCISO Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   During a ransomware incident, the incident response team discovers that the malware is using a custom protocol over TCP port 4444 to communicate with a command-and-control server. The team wants to contain the threat while preserving the ability to monitor the attacker's activity. Which action best balances containment and intelligence gathering?

   • ABlock all outbound traffic from the infected host except for DNS and HTTP, then wait for the attacker to reveal more infrastructure.
   • BImmediately power off the infected host and disconnect it from the network to stop the spread.
   • CBlock the specific C2 IP address at the firewall while allowing the malware to continue running on the infected host, and use a network tap to capture all traffic to that IP.
   • DAllow the C2 traffic to continue but use a proxy to modify the malware's responses to trick the attacker.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary goal of a Denial of Service (DoS) attack?

   • ATo alter the content of web pages
   • BTo make a service or resource unavailable to legitimate users
   • CTo gain unauthorized access to a network
   • DTo steal sensitive data from a server
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company has deployed an intrusion prevention system (IPS) in inline mode. After deployment, users report that legitimate traffic is being blocked, and some applications are failing. The IPS logs show that the blocked traffic matches a signature for a known exploit. What is the most likely cause, and what should the administrator do?

   • AThe IPS is generating false positives; the administrator should tune the IPS signatures and exceptions to reduce false positives while maintaining protection.
   • BThe IPS is placed in the wrong network segment; the administrator should move it to a different location.
   • CThe IPS is working correctly and the traffic is malicious; the administrator should leave the configuration as is.
   • DThe IPS is overloaded and dropping packets; the administrator should upgrade the hardware.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which tool is commonly used to capture and analyze network packets in real time for troubleshooting or security analysis?

   • AMetasploit
   • BWireshark
   • CNmap
   • DJohn the Ripper
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization wants to ensure that only company-owned and fully patched devices can connect to the internal network. Devices that do not meet the policy should be placed on a quarantine VLAN where they can access only the remediation servers. Which technology should be implemented?

   • AAn intrusion prevention system (IPS) that blocks traffic from unpatched devices.
   • BA stateful firewall with rules that block non-compliant devices based on MAC address.
   • CNetwork Access Control (NAC) with posture assessment and VLAN assignment.
   • DA VPN that requires multi-factor authentication for all network access.
   Reveal Solution Discussion Select an answer first