Network Security Controls and Devices SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team wants to learn about the tools and techniques used by attackers targeting their network. They plan to deploy a decoy system that appears legitimate but is not used for production. Which control should they implement?

   • AFirewall
   • BIntrusion detection system (IDS)
   • CHoneypot
   • DLoad balancer
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst notices repeated failed login attempts from a single internal IP to multiple servers. The analyst wants to receive real-time alerts when this pattern occurs and also wants to correlate it with authentication logs from domain controllers. Which two controls should be implemented together?

   • AUse a load balancer to distribute login traffic and enable its logging feature.
   • BDeploy an IDS on the internal network and forward its alerts to a SIEM that ingests domain controller logs.
   • CConfigure a VPN concentrator to require multi-factor authentication for all internal access.
   • DInstall a host-based firewall on each server to log failed logins and send email alerts.
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   A security team wants to learn about attacker techniques targeting their network without risking production systems. They plan to deploy a decoy environment that appears to be a real server and monitor the attacker's actions. Which control should they implement?

   • AConfigure a firewall to log all denied traffic.
   • BDeploy a honeypot and log all interactions to a SIEM for analysis.
   • CUse a load balancer to distribute traffic to a decoy server.
   • DInstall an IPS in inline mode to block all suspicious traffic.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is evaluating whether to deploy an IDS or an IPS. They have a high-throughput network and are concerned about false positives causing legitimate traffic to be blocked. They also need to retain evidence of attacks for later analysis. Which approach should they take?

   • ADeploy both an IDS and an IPS in parallel, with the IPS in inline mode and the IDS in passive mode.
   • BDeploy a firewall with intrusion prevention features and disable logging.
   • CDeploy an IPS in inline mode and configure it to log all blocked traffic.
   • DDeploy an IDS in passive mode and feed its alerts to a SIEM for analysis and evidence retention.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company operates a public-facing web application that experiences occasional DDoS attacks. They also need to block malicious traffic at the network edge. They have a limited budget and want to minimize latency for legitimate users. Which combination of controls should they deploy?

   • ADeploy a firewall with stateful inspection and a honeypot.
   • BDeploy a load balancer and a network access control (NAC) solution.
   • CDeploy an IPS inline at the network edge and a load balancer in front of the web servers.
   • DDeploy a DDoS protection service at the ISP level and an IPS inline at the network edge.
   Reveal Solution Discussion Select an answer first