Network Monitoring and Defense GCCC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which metric is most useful for evaluating the effectiveness of a security monitoring program?

   • ANumber of firewall rules
   • BTotal network bandwidth
   • CNumber of employees
   • DMean time to detect (MTTD)
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of integrating threat intelligence feeds into security monitoring?

   • ATo replace the need for log analysis
   • BTo automatically patch all vulnerabilities
   • CTo encrypt all network traffic
   • DTo enhance detection by providing indicators of compromise (IOCs) and attacker TTPs
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is investigating a potential breach. The SIEM shows that a user logged in from an unusual location at 2 AM, and then a large amount of data was transferred to an external IP. The analyst needs to determine if the login was legitimate. Which log source would provide the most useful evidence?

   • AEndpoint antivirus logs
   • BAuthentication logs with successful and failed login attempts
   • CFirewall logs showing the data transfer
   • DDNS logs for the external IP
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to protect its internal web application from common web attacks such as SQL injection and cross-site scripting (XSS). The application is hosted on a server in the DMZ. Which network defense technology should be deployed to specifically filter malicious web traffic?

   • AWeb application firewall (WAF).
   • BStateful firewall.
   • CNetwork-based intrusion detection system (NIDS).
   • DVirtual private network (VPN) concentrator.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is investigating a potential breach and needs to reconstruct the timeline of events across multiple systems. Which log management practice would be most helpful?

   • AStore logs locally on each system for the required retention period.
   • BUse a log management tool that only collects security alerts.
   • CCentralize logs from all systems with synchronized timestamps (e.g., NTP) into a searchable platform.
   • DEnable verbose logging on the firewall only.
   Reveal Solution Discussion Select an answer first