Network Attack Detection and Countermeasures EHE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During incident response, which step involves isolating affected systems to prevent the attack from spreading further?

   • ARecovery
   • BEradication
   • CPost-incident analysis
   • DContainment
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network administrator notices unusual outbound traffic from a single workstation at 3:00 AM. The traffic consists of small packets sent to many different external IP addresses on port 53. What is the most appropriate immediate action?

   • ACapture full packet data from that workstation's switch port and analyze the DNS queries for signs of data exfiltration.
   • BReboot the workstation to clear any temporary network connections.
   • CImmediately block all outbound UDP port 53 traffic at the firewall.
   • DIgnore the traffic because port 53 is commonly used for legitimate DNS queries.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After a ransomware attack, a company has restored its systems from backups. The incident response team is now conducting a post-incident review. What is the primary goal of this review?

   • AIdentify the root cause and implement improvements to prevent future incidents.
   • BDetermine the financial cost of the incident for insurance claims.
   • CDelete all logs and evidence to protect the company's reputation.
   • DAssign blame to the responsible parties.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst wants to correlate login failures from the firewall, malware alerts from endpoints, and outbound connection logs from the proxy to identify a coordinated attack. Which tool is designed for this type of correlation?

   • AA network-based IDS that inspects traffic for known attack signatures.
   • BA SIEM platform that ingests logs from multiple sources and applies correlation rules.
   • CA vulnerability scanner that identifies missing patches on servers.
   • DA packet sniffer that captures raw traffic on the core switch.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network administrator notices unusual spikes in traffic to a single server from many different IP addresses. The administrator wants to determine if this is a distributed denial-of-service (DDoS) attack or a legitimate flash crowd. Which analysis technique would provide the most useful information?

   • AExamine packet captures for common DDoS signatures, such as TCP SYN floods or UDP amplification, and compare the source IP distribution with known botnet lists.
   • BRun a vulnerability scan on the server to see if it has any open ports.
   • CCheck the server's CPU and memory usage to see if it is overloaded.
   • DReview the firewall logs to see which ports are being accessed.
   Reveal Solution Discussion Select an answer first