Technical Controls (firewalls, IDS/IPS, VPNs, SIEM) ECSS Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to automatically block malicious traffic at the network perimeter without requiring manual intervention for every alert. They also need to maintain visibility into blocked attempts for later analysis. Which deployment best achieves this?

   • ADeploy an IPS inline at the perimeter with automatic blocking and log all blocked traffic.
   • BDeploy an IDS inline but configure it to only alert on suspicious traffic.
   • CDeploy an IPS in passive mode and rely on the firewall to block traffic.
   • DDeploy an IDS in passive mode on a SPAN port and manually block IPs based on alerts.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a primary use case for an IPsec VPN?

   • AProviding anonymous web browsing
   • BReplacing the need for a firewall
   • CBlocking malware at the application layer
   • DSecuring site-to-site connections between two office networks
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is implementing a SIEM to meet a compliance requirement that mandates log retention for one year. The SIEM must also provide real-time alerting for suspicious activity. The team is concerned about storage costs. Which configuration best balances compliance and cost?

   • AStore only security-critical logs in the SIEM and discard the rest.
   • BStore all logs in the SIEM for one year and enable real-time correlation and alerting.
   • CStore logs in the SIEM for 30 days and archive older logs to cheaper storage, while maintaining real-time correlation and alerting.
   • DStore all logs in the SIEM for one year, but disable correlation to reduce processing load.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A remote employee needs to access internal resources securely from a public Wi-Fi network. The employee's device is company-managed and has a VPN client installed. Which VPN type should be used to ensure the connection is encrypted and authenticated?

   • ARemote-access VPN using IPsec.
   • BPPTP VPN for compatibility.
   • CSite-to-site VPN using IPsec.
   • DSSL/TLS VPN without a client.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security analyst needs to monitor traffic on a critical internal subnet and automatically block malicious packets without disrupting legitimate traffic. The solution must be able to drop packets that match known attack signatures. Which control should be deployed?

   • ADeploy a network tap feeding a packet capture appliance for forensic analysis.
   • BDeploy an intrusion prevention system (IPS) in inline mode on the subnet's gateway.
   • CDeploy an intrusion detection system (IDS) with a SPAN port on the subnet's switch.
   • DDeploy a firewall with a default allow rule for all traffic on the subnet.
   Reveal Solution Discussion Select an answer first