Network Perimeter Security CND Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization's network IDS generates frequent alerts for a signature that matches legitimate internal backup traffic. The alerts are consuming analyst time and are not associated with any actual compromise. What is the most appropriate action to reduce false positives while preserving detection of real threats?

   • AIncrease the IDS sensitivity threshold so fewer alerts are generated overall.
   • BDisable the IDS signature globally to stop the alerts.
   • CMove the IDS to passive mode so it only logs alerts without notifying analysts.
   • DCreate an IDS exception rule that suppresses alerts for the specific source and destination IP addresses of the backup servers.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network administrator notices that the firewall has blocked repeated inbound connection attempts from a single external IP address to port 3389 (RDP) on multiple internal hosts. The attempts have been occurring for several hours. What is the most appropriate immediate response?

   • ADisable the firewall to allow the traffic and monitor what the attacker is doing.
   • BIgnore the attempts because the firewall is blocking them and no breach has occurred.
   • CChange the internal hosts' IP addresses to avoid the scanning.
   • DAdd a temporary firewall rule to block the external IP address and review other logs for signs of successful compromise.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network administrator sees a spike in firewall logs showing outbound connections from multiple internal hosts to the same external IP on port 53 (DNS). The administrator suspects a DNS tunneling attack. What is the most appropriate first step?

   • AIgnore the traffic because DNS is a common protocol and the spike may be normal.
   • BAllow the traffic because DNS is essential and blocking it would disrupt operations.
   • CBlock outbound DNS to that external IP and investigate the internal hosts for signs of compromise.
   • DDisable the DNS service on all internal hosts to stop the traffic.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization has an IPS in inline mode. The IPS is generating a high volume of false positives that are blocking legitimate traffic. The security team wants to reduce false positives without significantly increasing the risk of missing real attacks. Which approach is most effective?

   • AIncrease the IPS sensitivity threshold to reduce the number of alerts.
   • BDisable the IPS signatures that are generating the most false positives.
   • CSwitch the IPS to passive mode so it only logs alerts without blocking.
   • DCreate exceptions for the specific source and destination IP addresses and ports of the legitimate traffic.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When configuring a firewall rule to allow inbound web traffic to a public web server, which information is typically required in the rule?

   • ASource port 80, destination port 80, and protocol UDP
   • BSource MAC address, destination MAC address, and VLAN ID
   • CDestination IP address and the user's username only
   • DSource IP address, destination IP address, destination port 80/443, and protocol TCP
   Reveal Solution Discussion Select an answer first