Administrative Network Security CND Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company's intrusion detection system (IDS) alerts on suspicious outbound traffic from a server that stores customer data. The alert occurs at 2:00 AM. The on-call administrator is unsure whether this is a real breach or a false positive. The company's incident response policy requires immediate action, but the administrator does not want to disrupt operations unnecessarily. What is the best first action?

   • ADisconnect the server from the internet but leave it connected to the internal network.
   • BIgnore the alert until the morning when the full security team is available.
   • CShut down the server immediately to stop any malicious activity.
   • DIsolate the server from the network to prevent potential data exfiltration while preserving logs for investigation.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A healthcare provider is subject to HIPAA and must conduct regular security audits. An audit reveals that several network devices have default passwords and that the audit log server is not synchronized to a central time source. The provider must remediate these findings. What is the most important remediation to prioritize?

   • AConduct a risk assessment to determine the likelihood of exploitation.
   • BChange all default passwords on network devices and implement a policy for strong, unique passwords.
   • CSynchronize the audit log server to a central time source (e.g., NTP).
   • DDocument the audit findings and create a remediation plan for the next fiscal year.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an example of a regulatory compliance requirement that may affect network administration?

   • ARequiring encryption of customer personal data in transit and at rest
   • BRequiring all network cables to be blue
   • CRequiring all employees to work from the office
   • DRequiring the use of a specific brand of firewall
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company has a high rate of employees falling for phishing emails. The security team wants to improve the security awareness program, but the budget is limited. The team must choose between purchasing a phishing simulation tool or developing in-house training videos. Which approach is most likely to be effective?

   • ACreate a one-time training video and require all employees to watch it
   • BUse a phishing simulation tool that provides metrics and targeted training to employees who fail
   • CSend monthly email reminders about phishing risks
   • DImplement a technical control that blocks all phishing emails
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A small law firm has just discovered that an employee's credentials were used to access a client database from an unknown IP address. The incident is confirmed. According to incident response best practices, what should the firm do first?

   • ARestore the database from the last backup to remove any unauthorized changes.
   • BImmediately delete the employee's account to prevent further access.
   • CNotify all clients that their data may have been compromised.
   • DIsolate the affected systems and preserve evidence before taking further action.
   Reveal Solution Discussion Select an answer first