Network Monitoring and Defense GCCC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A network administrator suspects that a compromised host is communicating with a command-and-control (C2) server using a non-standard port and intermittent connections. Which monitoring technique would be most effective in detecting this behavior?

   • AAnalyze NetFlow data for unusual destination ports and periodic connection patterns.
   • BCheck the host's ARP cache for unknown MAC addresses.
   • CPerform a port scan of the host to identify open ports.
   • DReview the host's local event logs for application errors.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center (SOC) receives alerts from multiple sources: firewall logs, IDS alerts, and endpoint detection and response (EDR) telemetry. The analysts are overwhelmed by the volume and often miss critical alerts. Which approach would most improve the efficiency and effectiveness of incident detection?

   • AIncrease the number of SOC analysts to manually review all alerts.
   • BStore all logs in a central database for later forensic analysis.
   • CDisable all alerts except those from the EDR system.
   • DImplement a SIEM platform to aggregate and correlate logs from all sources, with alert rules tuned to reduce false positives.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC is evaluating two threat intelligence feeds: Feed A provides real-time indicators but has a high false-positive rate; Feed B provides curated, high-confidence indicators but with a 24-hour delay. The SOC needs to block an ongoing attack that is using rapidly changing infrastructure. Which feed should the SOC prioritize for automated blocking?

   • AFeed A, because real-time indicators are critical for blocking rapidly changing attack infrastructure, despite the false positives.
   • BUse neither feed and rely on manual analysis of the attack.
   • CFeed B, because high-confidence indicators reduce false positives and are more reliable.
   • DUse both feeds equally, combining all indicators into the blocklist.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC manager wants to improve the team's detection capabilities but has a limited budget. The team currently relies on free, open-source tools for network monitoring. Which investment would provide the most significant improvement in detection effectiveness?

   • AInvest in training for the existing analysts on advanced threat hunting and tool usage.
   • BDeploy additional open-source monitoring tools to cover more data sources.
   • CHire additional SOC analysts to manually review logs and alerts.
   • DPurchase a commercial SIEM with advanced analytics and machine learning.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is planning to segment its network to improve security. The network includes a mix of legacy systems that cannot be patched and modern systems. The security team wants to limit the risk from the legacy systems while maintaining business operations. Which segmentation strategy is most appropriate?

   • AConnect legacy systems directly to the internet to isolate them from the internal network
   • BPlace legacy systems on a separate VLAN with strict access controls and monitor all traffic to and from that VLAN
   • CAllow legacy systems to communicate freely with all other systems
   • DDisable the legacy systems entirely
   Reveal Solution Discussion Select an answer first