Network Attack Detection and Countermeasures EHE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary purpose of analyzing network traffic with a network analyzer?

   • ATo detect anomalies and potential attacks
   • BTo enforce access control policies
   • CTo encrypt data in transit
   • DTo block malicious IP addresses
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During an incident, a compromised server is isolated. The incident response team needs to preserve evidence for potential legal action. What is the most important step?

   • ARun a full antivirus scan on the server.
   • BCreate a forensic image of the server's hard drive and store it securely.
   • CDelete any suspicious files to prevent further damage.
   • DReboot the server to clear any malware from memory.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   During a security incident, a server is sending outbound connections to a known command-and-control (C2) IP address. The server is also used by a critical business application that cannot be taken offline. Which containment strategy best balances security and business continuity?

   • ABlock outbound traffic from the server to the C2 IP at the firewall and monitor for other malicious activity.
   • BDisconnect the server from the network immediately.
   • CAllow the traffic to continue to gather more intelligence.
   • DShut down the server and restore from a backup.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A network administrator is troubleshooting a potential denial-of-service attack. The administrator wants to see if the attack is coming from a single source or multiple sources. Which tool would provide the most useful information?

   • AA SIEM dashboard showing aggregated alerts.
   • BA network scanner to identify open ports on the target.
   • CA firewall log showing allowed traffic.
   • DA packet sniffer to capture and analyze source IP addresses.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team wants to detect zero-day exploits that do not match any known signature. Which detection technique is best suited for this?

   • ASignature-based detection that relies on a database of known attack patterns.
   • BAnomaly-based detection that establishes a baseline of normal network behavior and flags deviations.
   • CStateful packet filtering that tracks connection states.
   • DManual log review performed once a week.
   Reveal Solution Discussion Select an answer first