Technical Controls (firewalls, IDS/IPS, VPNs, SIEM) ECSS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which VPN protocol is commonly used for secure remote access and operates at the application layer, often leveraging web browsers?

   • APPTP
   • BL2TP
   • CSSL/TLS
   • DIPsec
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team wants to reduce the time to detect a multi-stage attack that spans multiple servers. They plan to collect logs from firewalls, servers, and endpoints into a central system that can identify related events across different sources. Which SIEM function directly enables this capability?

   • ACompliance reporting
   • BCorrelation
   • CAlerting
   • DLog aggregation
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a screened subnet architecture, what is the purpose of placing a DMZ between two firewalls?

   • ATo host internal employee workstations and sensitive data
   • BTo isolate the internal network from all external traffic without any exceptions
   • CTo provide a secure area for public-facing servers with controlled access from both the internet and internal network
   • DTo eliminate the need for network address translation (NAT)
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC team is overwhelmed by the volume of alerts from their SIEM. Most alerts are false positives, and critical alerts are being missed. The team wants to reduce noise while ensuring that genuine threats are not overlooked. Which approach should be taken?

   • ATune correlation rules and implement alert prioritization based on asset criticality.
   • BIncrease the number of correlation rules to catch more events.
   • CDisable all alerts and rely on manual log review.
   • DReduce log sources to decrease data volume.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During incident response, how does a SIEM assist security analysts?

   • ABy providing a centralized view of logs and alerts to help investigate the incident
   • BBy isolating infected machines from the network
   • CBy automatically patching vulnerable systems
   • DBy deleting malicious files from endpoints
   Reveal Solution Discussion Select an answer first