Network Attack Detection and Countermeasures EHE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company has been hit by a ransomware attack that encrypts files on network shares. The IT team needs to restore the files. Which countermeasure would have most effectively mitigated the impact of this attack?

   • AMaintaining regular offline backups of critical data.
   • BDeploying an IDS to detect the ransomware traffic.
   • CEncrypting all data on the network shares.
   • DUsing a strong firewall to block inbound traffic from the internet.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is reviewing network traffic and notices a large number of ARP replies on the network. The analyst suspects an ARP spoofing attack. Which tool would be most effective to confirm this suspicion?

   • ARun a port scan to identify active hosts on the network.
   • BUse a packet sniffer to capture ARP traffic and analyze the MAC-to-IP mappings.
   • CReview the firewall logs for blocked ARP traffic.
   • DCheck the ARP cache on the switch to see if any entries are static.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team wants to detect network attacks in real time and automatically block malicious traffic. Which solution should they deploy?

   • AA network-based intrusion detection system (NIDS) with a SPAN port.
   • BA SIEM system that aggregates logs from multiple sources.
   • CAn intrusion prevention system (IPS) placed inline in the network path.
   • DA packet sniffer configured to capture all traffic for later analysis.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During incident response, a critical database server is infected with ransomware. The server holds the only copy of data needed for current operations. The team must restore service quickly, but also preserve evidence for a potential legal case. Which approach best balances these competing needs?

   • ADisconnect the server and leave it offline until the legal team decides what to do.
   • BTake a forensic image of the server's disk, then restore the server from a clean backup.
   • CImmediately reimage the server from a clean backup and skip evidence collection to restore service faster.
   • DKeep the server running to gather more forensic data, delaying recovery.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company wants to prevent an attacker who has compromised a single workstation from easily reaching the finance department's servers. Which countermeasure is most effective?

   • AInstall a host-based firewall on the workstation that blocks all inbound traffic.
   • BDeploy an IPS that only monitors traffic between the workstation and the internet.
   • CEncrypt all traffic on the internal network using IPsec.
   • DSegment the network so that the finance servers are on a separate subnet with strict ACLs.
   Reveal Solution Discussion Select an answer first