Network Monitoring and Defense GCCC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC wants to automatically block traffic to known malicious IP addresses. Which integration would enable this capability?

   • AConfigure the IDS to generate alerts for known malicious IPs.
   • BIntegrate threat intelligence feeds with the firewall or intrusion prevention system (IPS) to update blocklists automatically.
   • CUse a SIEM to display threat intelligence data on a dashboard.
   • DManually review threat reports and add IPs to a text file.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to integrate a free, community-sourced threat intelligence feed into their intrusion detection system (IDS). The feed contains IP addresses and domains that are frequently updated. The team is concerned about false positives and wants to minimize alert fatigue. Which integration approach is most appropriate?

   • AImport the feed into the IDS and alert on every match
   • BUse the feed as a correlation source in the SIEM, but only alert when multiple indicators match or when combined with other suspicious activity
   • CBlock all IPs and domains from the feed at the firewall immediately
   • DIgnore the feed because community sources are not reliable
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of regularly reviewing and updating monitoring metrics?

   • ATo identify areas for improvement and adapt to changing threats
   • BTo justify the purchase of more hardware
   • CTo simplify the network architecture
   • DTo reduce the number of security alerts
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC analyst detects a possible data exfiltration: a large outbound transfer from a file server to an external IP. The transfer is still ongoing. The analyst must decide whether to block the connection immediately or gather more evidence. The company has a legal requirement to preserve evidence for potential prosecution. What is the best course of action?

   • ABlock the connection immediately to stop the exfiltration, then capture a memory image of the file server.
   • BAllow the transfer to complete while capturing full packet data and logs, then block the IP and initiate incident response.
   • CRedirect the traffic to a honeypot to observe the attacker's actions.
   • DBlock the connection and immediately shut down the file server to preserve evidence.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is deploying a new internal application that must be accessible only to employees on the corporate network, not to guests on the guest Wi-Fi. Which access control measure would enforce this requirement?

   • ADeploy an intrusion detection system (IDS) on the application server.
   • BUse a strong password for the application.
   • CPlace the application server in a separate VLAN and configure firewall rules to allow access only from the corporate network subnet.
   • DEnable encryption on the application's network traffic.
   Reveal Solution Discussion Select an answer first