Technical Network Security CND Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has just experienced a network breach. The incident response team has contained the affected systems and collected forensic evidence. What is the next step in the incident response process?

   • AImmediately restore all systems from backups.
   • BEradicate the root cause and remove the threat from the environment.
   • CConduct a post-incident review to identify lessons learned.
   • DNotify law enforcement before doing anything else.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A network architect is designing a secure network for a small business. The business has a public web server, an internal file server, and employee workstations. Which placement of the web server is most secure?

   • ABehind the internal firewall with no additional segmentation.
   • BOn the same internal network segment as the file server.
   • COn a separate VLAN with no firewall between it and the internal network.
   • DIn a DMZ separated from the internal network by a firewall.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has experienced a data breach where customer data was exfiltrated. The incident response team needs to contain the breach and restore operations while preserving evidence for a legal investigation. Which two actions should the team take?

   • AIsolate the affected systems from the network and take forensic images of the systems.
   • BDisconnect the affected systems from the network and then reboot them.
   • CImmediately restore the systems from backups without isolating them.
   • DNotify law enforcement before taking any action.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A network analyst is reviewing captured traffic and notices a large number of TCP SYN packets sent to a single host from many different source IP addresses. What type of anomaly does this pattern most likely indicate?

   • AA DNS amplification attack
   • BA port scan
   • CNormal network behavior
   • DA SYN flood attack
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is designing a network for a new cloud-based application that will be accessed by employees from multiple branch offices. The company wants to ensure that traffic between branches and the cloud application is encrypted and that the application is protected from internet-based attacks. Which architecture best meets these requirements?

   • AUse a site-to-site VPN between each branch and the cloud provider, and place the application behind a cloud-based firewall and DDoS protection.
   • BUse a direct internet connection from each branch to the cloud application without encryption.
   • CPlace the application on the internal network and use a VPN for branch access.
   • DUse a remote access VPN for each employee and rely on the cloud provider's default security.
   Reveal Solution Discussion Select an answer first