Asset and Network Analytics GCDA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A vulnerability scan has identified a critical remote code execution vulnerability on a domain controller and a high-severity vulnerability on a public-facing web server. The domain controller is in a tightly segmented management network with strict access controls, while the web server is directly exposed to the internet. The organization has limited patching resources and can only patch one system this week. Which system should be patched first?

   • AThe web server, because it is internet-facing and has a higher likelihood of exploitation.
   • BThe domain controller, because the vulnerability is rated critical.
   • CNeither system, because the vulnerabilities are not currently being exploited.
   • DBoth systems simultaneously, because both are important.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary purpose of network topology mapping?

   • ATo understand the relationships and communication paths between assets
   • BTo replace the need for firewall rules
   • CTo automatically block malicious traffic
   • DTo identify the physical location of every employee
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary goal of traffic flow analysis in network security?

   • ATo block all external traffic
   • BTo encrypt all network communications
   • CTo identify normal behavior and detect anomalies
   • DTo replace the need for firewalls
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   During a network topology mapping exercise, an analyst discovers that a server in the PCI-DSS segment is able to communicate directly with a workstation in the general office segment. The analyst checks the firewall rules and finds that the segments are supposed to be isolated. What is the most appropriate action?

   • AIgnore the communication because the firewall is the only control and it is working.
   • BImmediately block all traffic between the two segments at the firewall.
   • CDocument the communication path and add it to the network baseline as normal.
   • DInvestigate why the communication is allowed, identify the responsible rule, and recommend a change to enforce segmentation.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An analyst is reviewing NetFlow records for a server that normally receives about 2 Mbps of inbound traffic during business hours. Over the past hour, the server has been receiving a steady 50 Mbps from a single external IP. The analyst checks the server's CPU and memory usage and sees no change. What is the most appropriate next step?

   • AInvestigate the external IP and the traffic pattern, correlating with other logs and threat intelligence.
   • BBlock the external IP at the firewall immediately.
   • CIncrease the server's bandwidth allocation to accommodate the new traffic.
   • DIgnore the traffic because the server is not showing performance issues.
   Reveal Solution Discussion Select an answer first