Network Attack Detection and Countermeasures EHE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During a security incident, a server is found to be communicating with a known command-and-control (C2) server. The incident response team has isolated the server from the network. What should be the next step in the incident response process?

   • AConduct a post-incident review to identify lessons learned.
   • BEradicate the threat by removing the malware and applying patches, then restore the system from a known-good backup.
   • CNotify law enforcement before taking any further action.
   • DImmediately rebuild the server from scratch without preserving any forensic evidence.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An analyst is investigating a potential data breach. The network traffic logs show a large amount of encrypted traffic to an external IP. The analyst suspects data exfiltration but cannot decrypt the traffic. Which approach would provide the most useful evidence?

   • AAttempt to decrypt the traffic using the server's private key.
   • BIgnore the traffic because it is encrypted and cannot be analyzed.
   • CUse a network analyzer to capture metadata such as packet sizes, timing, and connection durations, and correlate with SIEM logs.
   • DBlock the external IP immediately to stop the exfiltration.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After a network intrusion, the incident response team has contained the affected systems and eradicated the malware. What is the next major phase in the incident response process?

   • AContainment, which involves isolating additional affected systems.
   • BPost-incident analysis, which involves reviewing the incident and documenting lessons learned.
   • CRecovery, which involves restoring systems to normal operation and verifying they are clean.
   • DDetection, which involves identifying new indicators of compromise.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A network administrator wants to limit traffic between two internal departments to only the specific ports required for their business applications. Which countermeasure is most appropriate for this task?

   • AIntrusion prevention system (IPS)
   • BNetwork segmentation
   • CAccess control list (ACL)
   • DEncryption
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network administrator wants to detect a port scan targeting multiple hosts on the internal network. Which detection technique is most appropriate?

   • AUse a packet sniffer to capture all traffic and manually inspect every packet.
   • BEnable logging on the firewall and review logs only for inbound traffic to a single host.
   • CDeploy a honeypot to attract attackers and log their activities.
   • DConfigure the IDS to alert on multiple connection attempts to different ports on multiple hosts within a short time window.
   Reveal Solution Discussion Select an answer first