A network defender is configuring alerting for a virtual network. The security team wants to be notified immediately when a new VM is created, because unauthorized VMs could introduce risks. However, the development team creates VMs frequently as part of their workflow, and the security team is being overwhelmed by alerts. Which approach best addresses both concerns?

Create an alert for VM creation, but suppress alerts for VMs created by the development team's service account.

Disable VM creation alerts entirely.

Alert only on VM deletion events.

Send alerts only after business hours.

During a security review, a network defender discovers that a virtual machine's network adapter is configured in promiscuous mode. What is the PRIMARY security concern with this configuration?

The VM can capture all traffic on the virtual switch, potentially exposing sensitive data to unauthorized users

The VM will be unable to communicate with other VMs

The VM's performance will degrade significantly

The VM will automatically become the default gateway

A company is deploying a virtualized environment with a web server, an application server, and a database server. The security policy requires that the web server be accessible from the internet, the application server only from the web server, and the database only from the application server. Additionally, management access to the hypervisor must be isolated. Which design BEST meets these requirements?

Place all servers on the same virtual network and rely on host-based firewalls

Place all servers on the same VLAN and use a physical firewall

Create three separate virtual networks (web, app, db) with firewall rules allowing only the required traffic, and a separate management network for the hypervisor

Use one virtual network for all servers and a separate network for management

A network defender is setting up monitoring for a virtual network and wants to detect anomalies such as a VM suddenly communicating with a known command-and-control server. Which combination of tools would provide the most complete visibility?

A physical network tap on the uplink

NetFlow export from the virtual switch and an IDS that analyzes the flow data

Only the hypervisor's performance monitor

Only a host-based firewall on each VM

EC-CouncilCertified Network Defender

Domain 4Objective 1

Enterprise Virtual Network Security CND Practice Questions (Page 7)

Part of the Virtual, Cloud and Wireless Network Security domain, which makes up ~13% of our current practice bank.

41questions here

9free pages

5concepts

Questions 31–35

31expert · hard
A network defender is configuring alerting for a virtual network. The security team wants to be notified immediately when a new VM is created, because unauthorized VMs could introduce risks. However, the development team creates VMs frequently as part of their workflow, and the security team is being overwhelmed by alerts. Which approach best addresses both concerns?
Select an answer first
32application · medium
During a security review, a network defender discovers that a virtual machine's network adapter is configured in promiscuous mode. What is the PRIMARY security concern with this configuration?
Select an answer first
33expert · hard
A company is deploying a virtualized environment with a web server, an application server, and a database server. The security policy requires that the web server be accessible from the internet, the application server only from the web server, and the database only from the application server. Additionally, management access to the hypervisor must be isolated. Which design BEST meets these requirements?
Select an answer first
34application · medium
A network defender is setting up monitoring for a virtual network and wants to detect anomalies such as a VM suddenly communicating with a known command-and-control server. Which combination of tools would provide the most complete visibility?
Select an answer first
35expert · hard
A network defender discovers that a VM is sending traffic with the MAC address of another VM on the same virtual switch. This is causing the other VM to lose network connectivity. Which attack is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Enterprise Virtual Network Security CND Practice Questions (Page 7)

Questions 31–35

During a security review, a network defender discovers that a virtual machine's network adapter is configured in promiscuous mode. What is the PRIMARY security concern with this configuration?

A network defender is setting up monitoring for a virtual network and wants to detect anomalies such as a VM suddenly communicating with a known command-and-control server. Which combination of tools would provide the most complete visibility?

A network defender discovers that a VM is sending traffic with the MAC address of another VM on the same virtual switch. This is causing the other VM to lose network connectivity. Which attack is this?

Keep studying — Virtual, Cloud and Wireless Network Security