Countermeasures Across Hacking Phases EHE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A network administrator notices repeated port scans from external IPs targeting the company's DMZ. The scans are probing for open ports on a legacy web server that must remain accessible to the public. Which combination of countermeasures would best mitigate the scanning while keeping the web service available?

   • AChange the web server's IP address daily and update the DNS record accordingly.
   • BMove the web server to a different subnet without updating firewall rules.
   • CPlace the web server behind a firewall that only allows inbound traffic on port 443 and configure an intrusion prevention system (IPS) to block repeated scan patterns.
   • DDisable the web server's network interface during off-peak hours.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which tool is specifically designed to detect and prevent backdoors and rootkits?

   • AVulnerability scanner
   • BIntrusion prevention system (IPS)
   • CEndpoint detection and response (EDR) solution
   • DNetwork firewall
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A small business runs a web server and a database server on the same flat network segment. They want to reduce the risk of an attacker using port scanning and enumeration to discover the database service. Which action is the most effective countermeasure?

   • AInstall an intrusion detection system (IDS) on the web server to monitor for SQL injection attempts.
   • BPlace the database server on a separate network segment with a firewall rule that only allows the web server to connect to it.
   • CDisable the database service during off-peak hours.
   • DChange the database service to listen on a non-default port.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A small business runs a file server that stores sensitive client contracts. Employees access it from the office LAN. The IT admin wants to prevent unauthorized access if an attacker gains a foothold on the network. Which control is most effective for this goal?

   • AUse a complex password policy that requires 12-character passwords changed every 30 days.
   • BRequire multi-factor authentication (MFA) for all file server logins.
   • CDisable the file server's network discovery feature.
   • DInstall a network-based intrusion detection system (IDS) on the LAN.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security administrator is investigating a server that may be compromised. The administrator notices that the server's system logs stop at a certain time and then resume later, with no events during that gap. Which countermeasure would have helped detect this suspicious activity?

   • AEnable verbose logging for all services on the server.
   • BConfigure the server to send logs to a remote syslog server as soon as they are generated.
   • CIncrease the log retention period to 90 days.
   • DSet the system clock to synchronize with an NTP server.
   Reveal Solution Discussion Select an answer first