Network Monitoring and Defense GCCC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which log analysis technique is used to identify patterns that may indicate a coordinated attack?

   • ADeleting logs older than 30 days
   • BReviewing logs in chronological order only
   • CEncrypting log files
   • DCorrelating events across multiple log sources
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which response action is taken to prevent an ongoing attack from spreading further?

   • ADeleting all logs
   • BIsolating the affected network segment
   • CIgnoring the alert until more data is collected
   • DRebuilding the entire infrastructure
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During routine monitoring, a SOC analyst notices a large volume of traffic from an internal server to an external IP address on port 22 (SSH) at unusual hours. The server is not supposed to initiate SSH connections. What should the analyst do first?

   • AIgnore the traffic because it is outbound and not a direct threat.
   • BReview the server's authentication logs and correlate with the network flow data to determine if the connection is authorized.
   • CReboot the server to terminate any malicious processes.
   • DImmediately block the external IP address at the firewall.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary function of an intrusion prevention system (IPS) in network defense?

   • ATo passively log traffic for later analysis
   • BTo encrypt all network traffic
   • CTo actively block detected malicious traffic in real time
   • DTo route traffic between different network segments
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company's log management system is receiving logs from multiple sources, but the logs have inconsistent timestamp formats and timezone offsets. This makes correlation difficult. What is the most effective solution?

   • AIgnore the timestamp inconsistencies and rely on the order of log arrival.
   • BUse a separate log management system for each timezone.
   • CNormalize all logs to a single timezone (e.g., UTC) and standardize the timestamp format during ingestion.
   • DStore logs in their original format and manually adjust for timezone differences during analysis.
   Reveal Solution Discussion Select an answer first