Network Perimeter Security CND Practice Questions (Page 8)

Questions 36–39

1. 36expert · hard

   A security analyst is investigating a potential breach. The firewall logs show a large amount of outbound data transferred from an internal server to an external IP over the past week. The IDS has not alerted. The analyst needs to determine if this is a data exfiltration. Which action is most appropriate?

   • ACorrelate the firewall logs with the server's application logs and network flow data to identify the process and data involved.
   • BIgnore the traffic because the IDS did not alert.
   • CReboot the server to stop any malicious processes.
   • DImmediately block the external IP and assume it is data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   An IPS is deployed inline at the perimeter. The security team is experiencing a high rate of false positives that are blocking legitimate business traffic. They need to reduce false positives without significantly increasing the risk of missing real attacks. Which approach is most effective?

   • AIncrease the IPS threshold for all signatures to reduce the number of alerts.
   • BDisable the IPS and rely on the firewall for protection.
   • CSet the IPS to alert-only mode for all signatures to stop blocking legitimate traffic.
   • DTune the IPS signatures by disabling or modifying the ones that are causing false positives, and test the changes in a staging environment.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network defender is tuning an IPS that is deployed inline at the perimeter. The IPS is blocking legitimate traffic because a signature is too broad. The defender wants to maintain protection against the underlying attack while reducing false positives. What should they do?

   • AModify the signature to be more specific, such as requiring a particular payload pattern or destination port.
   • BIncrease the IPS sensitivity to catch more variants of the attack.
   • CSet the IPS to alert-only mode for that signature.
   • DDisable the IPS and rely on the firewall for protection.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company has a remote-access VPN that uses IPsec. The security team wants to enforce a policy that only allows VPN connections from company-issued laptops. The VPN concentrator supports certificate-based authentication. Which configuration best enforces the policy?

   • ARequire a client certificate issued by the company's PKI, and configure the VPN to reject connections without a valid certificate.
   • BAllow VPN connections from any device, but require multi-factor authentication.
   • CRequire a valid username and password for VPN authentication.
   • DUse a pre-shared key for all VPN connections.
   Reveal Solution Discussion Select an answer first