Network Attack Detection and Countermeasures EHE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company wants to protect its internal network from external attacks while also allowing employees to access the internet. They are considering a next-generation firewall (NGFW). Which capability of an NGFW provides the most additional security compared to a traditional stateful firewall?

   • AStateful packet inspection that tracks connection states.
   • BVirtual private network (VPN) support for remote access.
   • CNetwork address translation (NAT) to hide internal IP addresses.
   • DApplication awareness and intrusion prevention at the application layer.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   After a network breach, the incident response team has identified the entry point and the malware used. They have contained the affected systems. What is the most important next step to prevent a repeat of the same attack?

   • AIncrease logging verbosity on all systems to capture more data.
   • BRestore all systems from backups taken before the breach.
   • CChange all user passwords and enforce multi-factor authentication.
   • DPatch the vulnerability that was exploited and update detection signatures for the malware.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is deploying a new web application and wants to protect it from common web attacks such as SQL injection and cross-site scripting (XSS). Which countermeasure should be implemented at the network layer?

   • AImplement network segmentation to isolate the application server.
   • BDeploy a web application firewall (WAF) in front of the application server.
   • CUse an IDS to monitor traffic to the application server.
   • DEnable encryption with TLS on the application server.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst notices a sudden increase in outbound traffic from a server that normally sends very little data. The traffic is encrypted and goes to a single external IP. The analyst must determine if this is data exfiltration. Which action is most effective?

   • AIgnore the traffic because it is encrypted and cannot be analyzed.
   • BBlock the external IP address immediately at the firewall.
   • CCompare the traffic volume and destination against a baseline and investigate the server's processes for suspicious activity.
   • DDecrypt the traffic using the server's SSL keys to inspect the contents.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security analyst is configuring a SIEM to reduce false positives. The SIEM currently generates too many alerts for normal network behavior. Which approach is most effective?

   • ATune the correlation rules to baseline normal traffic and adjust thresholds accordingly.
   • BDisable all alerts for low-priority events.
   • CIncrease the number of log sources feeding into the SIEM.
   • DUpgrade the SIEM to a more expensive version.
   Reveal Solution Discussion Select an answer first