Administrative Network Security CND Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary goal of a disaster recovery plan?

   • ATo replace the need for regular backups
   • BTo ensure that employees never work remotely
   • CTo restore critical IT systems and data after a disruptive event
   • DTo prevent all disasters from occurring
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company experiences a ransomware attack that encrypts files on several servers. The incident response team is activated. The CEO wants to pay the ransom to restore data quickly, but the security team advises against it. What is the best course of action?

   • APay the ransom immediately to minimize downtime
   • BIgnore the incident and hope the attackers do not cause more damage
   • CShut down all servers and reimage them without preserving evidence
   • DFollow the incident response plan, contain the spread, restore from backups, and report the incident to law enforcement
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A hospital's network administrator discovers that a legacy medical device runs an unsupported operating system with known critical vulnerabilities. The device is essential for patient monitoring and cannot be replaced for six months. The device is on the same network segment as other hospital systems. The administrator must balance patient safety, security, and operational continuity. What is the best course of action?

   • AImmediately disconnect the device from the network to eliminate the vulnerability
   • BReplace the device immediately with a newer model, regardless of budget constraints
   • CIsolate the device on a separate VLAN with strict firewall rules, monitor its traffic, and document the accepted risk with executive approval
   • DApply an unofficial patch from a third-party website to fix the vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A hospital network administrator is managing a fleet of Windows servers that host patient records. A critical patch from Microsoft is released, but the patch requires a reboot and is known to conflict with the hospital's legacy medical imaging software. The hospital cannot afford downtime during business hours. The risk assessment indicates that the vulnerability is being actively exploited in the wild. What is the best course of action?

   • AApply the patch only to the servers that are directly exposed to the internet and leave internal servers unpatched.
   • BDo not apply the patch and instead increase monitoring and firewall rules to mitigate the vulnerability.
   • CApply the patch immediately to all servers, including those running the imaging software, to stop the active exploitation.
   • DApply the patch to non-critical servers first, test the imaging software in a lab, then schedule a maintenance window for the critical servers.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which step in the risk management process involves prioritizing risks based on their likelihood and impact?

   • ARisk mitigation
   • BRisk identification
   • CRisk monitoring
   • DRisk assessment
   Reveal Solution Discussion Select an answer first