Network Attack Detection and Countermeasures EHE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During incident response, a compromised server is identified as the source of a malware infection that is spreading to other hosts. The team needs to stop the spread while preserving evidence for analysis. Which step should be performed first?

   • AIsolate the compromised server from the network by disconnecting its network cable or disabling its switch port.
   • BRun a full antivirus scan on the server and delete any detected malware files.
   • CReimage the server immediately with a clean operating system.
   • DNotify all users to avoid using the network until the malware is removed.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which security tool is primarily used to collect and correlate logs from multiple sources to provide a centralized view of security events across an organization?

   • APacket sniffer
   • BIntrusion Detection System (IDS)
   • CSecurity Information and Event Management (SIEM) system
   • DIntrusion Prevention System (IPS)
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company is implementing a defense-in-depth strategy. They already have a firewall and an IDS. Which additional countermeasure would most effectively enhance their security posture?

   • AReplace the firewall with a more expensive model.
   • BRemove the IDS because the firewall is sufficient.
   • CEncrypt all traffic with TLS.
   • DDeploy a network-based IPS in addition to the existing firewall and IDS.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A network administrator must monitor traffic on a high-throughput core link. The monitoring server is dropping packets because the volume exceeds its capture capacity. The administrator needs to identify anomalies without missing critical events. Which approach is most effective?

   • ADeploy the monitoring server on a lower-speed link and infer core traffic behavior.
   • BIncrease the packet capture buffer on the monitoring server to hold more data.
   • CUse flow-based monitoring (e.g., NetFlow) to summarize traffic statistics instead of capturing full packets.
   • DCapture only packets that match known attack signatures.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is planning to segment its network to protect sensitive data. However, the finance department needs to share files with the marketing department, and the marketing department needs internet access. The company also wants to monitor for suspicious activity. Which design best meets these requirements?

   • ACreate separate VLANs for finance and marketing, apply ACLs to allow only necessary traffic between them, and place an IDS on the inter-VLAN trunk.
   • BCreate separate VLANs but allow all traffic between them to ensure business continuity.
   • CUse a single VLAN and deploy an IPS to monitor all traffic.
   • DPlace all departments on the same VLAN and rely on a firewall to filter traffic.
   Reveal Solution Discussion Select an answer first