Technical Network Security CND Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the first step in the incident response process?

   • AContainment
   • BPreparation
   • CEradication
   • DRecovery
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company has a remote workforce that needs to access internal resources. The security team is considering two solutions: a traditional VPN and a zero-trust network access (ZTNA) solution. The company's main concerns are reducing the attack surface and ensuring that only authorized users can access specific applications. Which solution better addresses these concerns?

   • ABoth are equally effective, so the choice depends on cost.
   • BZTNA, because it provides application-level access control and does not grant broad network access.
   • CTraditional VPN, because it encrypts all traffic and is easier to deploy.
   • DTraditional VPN, because it is more compatible with legacy applications.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   After a security incident has been contained and eradicated, what is the primary goal of the recovery phase?

   • ATo collect evidence for legal proceedings
   • BTo restore affected systems and services to normal operation
   • CTo update the incident response plan
   • DTo identify the root cause of the incident
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In secure network architecture design, what is the purpose of network segmentation?

   • ATo eliminate the need for firewalls
   • BTo isolate different trust zones and limit the spread of attacks
   • CTo combine all network traffic into a single flat network
   • DTo increase the number of broadcast domains
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network analyst is reviewing packet captures and notices that a server is sending large amounts of data to an external IP address during non-business hours. The server is not supposed to communicate with external IPs. Which two steps should the analyst take to investigate this potential data exfiltration?

   • ABlock the external IP address at the firewall immediately.
   • BDisconnect the server from the network and then review the packet captures.
   • CCheck the server's running processes and network connections to identify the application responsible for the traffic.
   • DReboot the server to clear any malicious processes and then monitor the traffic.
   Reveal Solution Discussion Select an answer first