Asset and Network Analytics GCDA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of an anomaly that might be detected?

   • AA user logging in during business hours
   • BA sudden spike in outbound traffic from a workstation at 3 AM
   • CRegular daily backup traffic at 2 AM
   • DA server responding to HTTP requests on port 80
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A detection analyst is tasked with building an initial asset inventory for a segment that contains a mix of managed and unmanaged devices. The analyst has access to the existing DHCP logs, NetFlow data, and an active scanner. The network team warns that the segment contains several legacy medical devices that are known to crash when scanned aggressively. Which approach best balances completeness with safety?

   • ARely solely on DHCP logs to build the inventory, since they contain every IP address that has been assigned.
   • BUse passive discovery from NetFlow and DHCP logs first, then run a low-intensity active scan only on IPs not seen in passive data.
   • CUse NetFlow data only, because it shows all active communication and avoids any risk to the medical devices.
   • DRun a full active scan with default intensity to identify all devices, then cross-reference with DHCP logs.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A detection analyst is reviewing NetFlow data and notices that a workstation is sending a large amount of data to an external IP address during off-hours. The workstation is a standard user endpoint, and the external IP is not in any threat intelligence feed. The analyst has a baseline that shows this workstation normally sends less than 1 MB per day. Which conclusion is most appropriate?

   • AThe baseline is incorrect and should be updated to reflect this new traffic pattern.
   • BThe workstation is compromised and exfiltrating data.
   • CThe external IP is not in the threat feed, so the traffic is likely benign.
   • DThe anomaly is significant and warrants further investigation, but it is not conclusive evidence of compromise.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A detection analyst is reviewing a packet capture and sees a series of TCP packets with the FIN and ACK flags set, sent from an internal host to an external IP. The packets are sent at a steady rate, and the external IP is not in any threat intelligence feed. Which interpretation is most appropriate?

   • AThe host may be compromised and using FIN/ACK packets for covert communication or scanning.
   • BThe host is sending a large number of FIN/ACK packets as part of a normal TCP connection teardown.
   • CThe host is performing a port scan using FIN scans.
   • DThe traffic is benign because the external IP is not in a threat feed.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is investigating a series of alerts. The firewall log shows outbound connections from a workstation to a known command-and-control (C2) domain. The DNS log shows the workstation resolving that domain. The endpoint detection log shows no malicious process on the workstation. The analyst must decide whether to escalate the incident. What is the most appropriate decision?

   • ADo not escalate because the endpoint detection shows no malicious process.
   • BEscalate the incident, but note the discrepancy between network and endpoint indicators and recommend further investigation.
   • CEscalate the incident because the firewall and DNS logs confirm the workstation is compromised.
   • DClose the case because the domain may be a false positive in the threat intelligence feed.
   Reveal Solution Discussion Select an answer first