Network Attacks and Defense Strategies CND Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which incident response phase involves removing the cause of the incident and eliminating the threat from the environment?

   • AEradication
   • BRecovery
   • CIdentification
   • DContainment
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A network defender is configuring an intrusion detection system (IDS) to monitor traffic on a high-speed backbone link. The IDS is placed on a SPAN port and is missing packets during peak traffic periods. The defender needs to improve detection without dropping packets. Which of the following is the most effective solution?

   • AIncrease the SPAN port buffer size on the switch.
   • BMove the IDS to an inline IPS to inspect traffic as it passes through.
   • CDeploy multiple IDS sensors, each monitoring a subset of the traffic using network taps.
   • DUse a sampling technique to analyze only a percentage of the traffic.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A web developer notices that the company's public website is displaying an error message that includes part of a SQL query. The developer suspects a SQL injection vulnerability. What is the most effective way to confirm the vulnerability and prevent it?

   • AUse a web application firewall (WAF) to block all requests containing SQL keywords.
   • BDisable error messages on the production server to hide the vulnerability.
   • CRun a vulnerability scanner to confirm the vulnerability and then patch the database server.
   • DReview the application code for dynamic SQL queries and use parameterized queries.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company's internet-facing DNS server is experiencing a volumetric DDoS attack that is saturating the uplink. The attack traffic is coming from many different IP addresses and is targeting the DNS server with large queries. The company has a limited budget and needs to maintain DNS availability for external users. Which mitigation strategy is the most cost-effective and appropriate?

   • AIncrease the bandwidth of the internet connection to absorb the attack.
   • BBlock the source IP addresses using the firewall's access control list.
   • CDeploy an on-premises intrusion prevention system (IPS) to filter the attack traffic.
   • DUse a cloud-based DDoS mitigation service that can absorb the traffic and filter it before it reaches the network.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A web application allows users to upload profile pictures. A security tester discovers that by uploading a file with a .php extension, they can execute arbitrary code on the server. The application validates the file extension but does not check the file content. What is the most effective way to fix this vulnerability?

   • ABlock all file uploads with a .php extension.
   • BRename the uploaded file to a random name with a .txt extension.
   • CUse a web application firewall (WAF) to block requests with suspicious file uploads.
   • DStore uploaded files in a directory outside the web root and serve them through a script that sets the correct Content-Type.
   Reveal Solution Discussion Select an answer first