Technical Controls (firewalls, IDS/IPS, VPNs, SIEM) ECSS Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   An organization wants to host a public web server and an email server while keeping the internal corporate network separate. They plan to place the public-facing servers in a network segment that is isolated from the internal LAN but still accessible from the internet. Which firewall architecture best describes this design?

   • ADual-homed host architecture
   • BSingle firewall with a single trusted interface
   • CScreened subnet (DMZ)
   • DBastion host architecture
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization's IDS generates a high volume of false positives because it flags any traffic that deviates from a baseline of normal network behavior. Which detection method is being used, and what is a common drawback?

   • ABehavior-based detection; it requires a training period to learn normal behavior.
   • BSignature-based detection; it cannot detect unknown attacks.
   • CAnomaly-based detection; it may flag legitimate deviations as threats.
   • DHeuristic-based detection; it uses rules to identify suspicious patterns.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company must demonstrate to an auditor that they have a centralized view of security events and can produce reports on login failures and firewall denies for the past six months. Which tool is specifically designed to aggregate logs from multiple sources and generate compliance reports?

   • ASIEM
   • BNetwork-based IDS
   • CFirewall
   • DVPN concentrator
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security manager wants to provide a single dashboard for monitoring security events across the organization and generate compliance reports. The solution must collect logs from multiple sources and normalize them. Which technology should be used?

   • ASIEM platform.
   • BSyslog server with no analysis.
   • CNetwork firewall with logging.
   • DAntivirus console.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   How can a SIEM support compliance reporting?

   • ABy encrypting all sensitive data in the organization
   • BBy replacing the need for external audits
   • CBy automatically blocking non-compliant devices
   • DBy generating reports that demonstrate adherence to security policies and regulations
   Reveal Solution Discussion Select an answer first