Network Security Controls and Devices SCE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC team is overwhelmed by thousands of alerts per day from multiple IDS/IPS sensors. Most alerts are false positives, but the team fears missing a real attack. They want to reduce noise while maintaining detection coverage. Which approach is most effective?

   • ADeploy more IDS sensors to provide additional context.
   • BDisable all IDS/IPS alerts and rely on manual log review.
   • CTune the SIEM correlation rules to group related alerts and suppress known false positives.
   • DIncrease the sensitivity of all IDS/IPS sensors to catch more threats.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does DDoS protection mitigate volumetric attacks?

   • ABy encrypting all traffic to the target
   • BBy absorbing and filtering attack traffic before it reaches the target
   • CBy patching the target server
   • DBy blocking all incoming traffic
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the key difference between an Intrusion Prevention System (IPS) and an Intrusion Detection System (IDS)?

   • AIPS actively blocks malicious traffic, while IDS only generates alerts.
   • BIPS monitors traffic, while IDS blocks traffic.
   • CIPS is deployed on the network, while IDS is deployed on a host.
   • DIPS uses signatures, while IDS uses anomaly detection.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which type of network security control is specifically intended to reduce the likelihood of a successful attack by limiting exposure?

   • ACompensating control
   • BDetective control
   • CPreventive control
   • DCorrective control
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company's web application is frequently targeted by DDoS attacks that overwhelm the network link. They want to maintain availability for legitimate users while minimizing the impact on performance. Which approach should they take?

   • ADeploy a load balancer to distribute the attack traffic across multiple servers.
   • BDeploy a DDoS protection service that scrubs traffic before it reaches the network.
   • CDeploy a firewall with rate limiting to slow down attack traffic.
   • DDeploy an intrusion prevention system (IPS) inline to block attack traffic.
   Reveal Solution Discussion Select an answer first