Network Attack Detection and Countermeasures EHE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A small business cannot afford a full SIEM solution but wants to improve its ability to detect network attacks. Which approach is most cost-effective and practical?

   • ADeploy an open-source IDS such as Snort and regularly review its alerts.
   • BRely solely on firewall logs and manual review.
   • CHire a 24/7 security operations center (SOC) to monitor the network.
   • DPurchase a commercial SIEM with advanced analytics.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A small company has a single flat network segment and wants to detect suspicious lateral movement between workstations. They already have a firewall at the perimeter. Which approach best addresses this need?

   • AInstall host-based antivirus on each workstation and rely on signature updates.
   • BConfigure the existing switch to block all traffic between workstations.
   • CEnable logging on the perimeter firewall and review only inbound connection attempts.
   • DDeploy a network-based IDS sensor on the internal switch mirror port and review alerts for internal-to-internal traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has a flat network where all employees can reach the finance department's servers. After a recent breach, the CISO wants to limit lateral movement. Which countermeasure is most effective as a first step?

   • AIncrease the frequency of vulnerability scans on all servers.
   • BEncrypt all traffic between clients and servers using TLS.
   • CImplement network segmentation and apply ACLs to restrict traffic between departments.
   • DDeploy a network-based intrusion detection system to monitor for suspicious activity.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has suffered a ransomware attack. The incident response team has contained the spread and is now deciding whether to pay the ransom or restore from backups. The backups are known to be clean but are 48 hours old. The company's operations are severely impacted. What is the best course of action?

   • APay the ransom to quickly regain access to data.
   • BWait for law enforcement to provide a decryption key.
   • CAttempt to decrypt the files using free decryption tools.
   • DRestore from the clean backups and accept the loss of 48 hours of data.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A security analyst needs a system that can automatically block malicious traffic in real time without requiring manual intervention. Which type of system is specifically designed to do this?

   • ANetwork firewall
   • BIntrusion Detection System (IDS)
   • CSecurity Information and Event Management (SIEM) system
   • DIntrusion Prevention System (IPS)
   Reveal Solution Discussion Select an answer first