Asset and Network Analytics GCDA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is typically included in a network baseline?

   • AThe passwords of all users
   • BNormal traffic volume and communication patterns
   • CThe contents of all emails
   • DThe physical location of every server
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A detection analyst is investigating a potential compromise. The analyst has the following data: a firewall log showing an outbound connection from a workstation to an external IP on port 443, a DNS log showing a query for a suspicious domain, and an endpoint log showing a new process running from a temp directory. Which action would best confirm whether these events are related?

   • ACheck the workstation's patch level.
   • BCorrelate the timestamps and source IPs across all three logs.
   • CBlock the external IP address at the firewall.
   • DRun a vulnerability scan on the workstation.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A detection analyst is mapping the network topology of a critical segment. The analyst has NetFlow data showing communication between servers, but the data does not show the physical or logical path between them. Which additional data source would be most useful to complete the topology map?

   • AEndpoint logs showing running processes.
   • BVulnerability scan results for each server.
   • CSwitch and router configuration files showing VLANs and routing tables.
   • DDNS logs showing hostname resolutions.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization has a dynamic environment where virtual machines are created and decommissioned frequently. The asset inventory is manually updated and is often out of date. What is the most effective way to maintain an accurate inventory?

   • ARequire administrators to submit a ticket whenever they create or decommission a VM.
   • BUse the virtualization platform's built-in list of VMs as the inventory and do not maintain a separate one.
   • CUse an automated discovery tool that integrates with the virtualization platform and regularly syncs the inventory.
   • DPerform a manual inventory review at the end of each month.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An organization is merging with another company and needs to integrate the new company's network. The new network has no documentation, and the security team must discover all assets without disrupting operations. The new network is known to contain both Windows and Linux systems, and there are concerns about legacy devices that may not respond to active scans. Which discovery approach is most appropriate?

   • AUse passive network monitoring to capture traffic and identify hosts, then supplement with active scans for non-responding devices.
   • BUse only active scans because they are more comprehensive.
   • CUse only passive monitoring because it is non-disruptive.
   • DRun an active Nmap scan against all subnets to identify hosts and open ports.
   Reveal Solution Discussion Select an answer first