Technical Network Security CND Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which network monitoring technique involves collecting and analyzing flow data to identify traffic patterns and potential anomalies?

   • APacket capture
   • BVulnerability scanning
   • CLog analysis
   • DFlow analysis
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is investigating a potential data exfiltration incident. The logs show that a large amount of data was transferred from an internal server to an external IP address over HTTPS. The analyst cannot decrypt the traffic. What is the best next step to confirm the exfiltration?

   • AUse a packet capture tool to capture and decrypt the HTTPS traffic.
   • BIgnore the event because HTTPS traffic is encrypted and cannot be malicious.
   • CCorrelate the transfer with other logs, such as authentication logs and endpoint activity, to identify the user and process responsible.
   • DBlock the external IP address immediately to stop the transfer.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network analyst is monitoring traffic and notices that a workstation is sending ICMP echo requests to a large number of external IP addresses in a short period. This pattern is consistent with a ping sweep. Which two actions should the analyst take to respond to this potential reconnaissance activity?

   • AIgnore the traffic because ICMP is a normal protocol.
   • BDisconnect the workstation from the network and then restart it.
   • CChange the workstation's IP address and continue monitoring.
   • DBlock the workstation's IP address at the firewall and investigate the workstation for malware.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A network administrator is setting up a monitoring system to detect anomalies in network traffic. Which two techniques should the administrator use to establish a baseline and identify deviations?

   • AMonitor system logs for failed login attempts.
   • BUse a packet analyzer to capture all traffic and manually review it.
   • CUse a signature-based IDS to detect known attack patterns.
   • DCollect netflow data over a period of normal operation and use statistical analysis to identify deviations.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security architect is designing a multi-layered defense strategy for a corporate network. Which of the following best describes the purpose of defense-in-depth?

   • ATo eliminate all security risks by implementing one comprehensive firewall
   • BTo provide multiple layers of security controls so that if one layer fails, others still protect the network
   • CTo rely on a single strong security control to block all attacks
   • DTo focus only on perimeter security to keep external attackers out
   Reveal Solution Discussion Select an answer first