Network Attack Detection and Countermeasures EHE Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A security analyst at a mid-sized company notices that an internal web server has been sending a large volume of outbound traffic to an external IP address at 3:00 AM every day for the past week. The analyst suspects a data exfiltration attempt but is unsure if it is legitimate backup activity. Which combination of actions would best confirm the suspicion while minimizing disruption?

   • AReview the SIEM logs for the server, capture and analyze the outbound traffic with a packet sniffer, and check the destination IP against threat intelligence feeds.
   • BImmediately block the external IP address at the firewall and then review the server logs to see if any other systems are affected.
   • CRun a vulnerability scanner on the web server to identify potential weaknesses that could be exploited.
   • DDisconnect the server from the network and then inspect the traffic captures from the firewall.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A network analyst is investigating a possible ARP spoofing attack. Which packet capture observation would most strongly indicate ARP spoofing?

   • AMultiple ARP replies on the network claiming the same IP address maps to different MAC addresses.
   • BLarge ICMP echo requests from an unknown external IP.
   • CDNS queries for unusual domain names from multiple hosts.
   • DA high volume of TCP SYN packets sent to a single port.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which countermeasure is most effective for protecting sensitive data transmitted over an untrusted network, such as the internet?

   • AEncryption
   • BIntrusion detection system (IDS)
   • CAccess control list (ACL)
   • DNetwork segmentation
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security architect must choose between an IDS and an IPS for a network segment that handles time-sensitive financial transactions. The primary concern is that security controls must not introduce latency or drop legitimate traffic. Which choice best meets this requirement?

   • AUse only a firewall with stateful inspection and no IDS/IPS.
   • BDeploy an IPS in inline mode with automatic blocking enabled.
   • CDeploy an IDS in passive mode, monitoring a mirror port and alerting on suspicious activity.
   • DDeploy an IPS in monitor mode, which is the same as an IDS.
   Reveal Solution Discussion Select an answer first