Asset and Network Analytics GCDA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A detection analyst is reviewing network traffic to understand the communication paths between a web server, an application server, and a database server. The analyst needs to identify which assets communicate with each other and on which ports. Which data source would provide the most direct evidence of these communication paths?

   • AConfiguration management database (CMDB) records of server roles.
   • BDNS logs showing which hostnames are resolved by each server.
   • CVulnerability scan results for each server.
   • DNetFlow records from the core router showing source and destination IPs and ports.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which asset discovery approach is least likely to be detected by network security monitoring because it does not generate new traffic?

   • AVulnerability assessment
   • BActive scanning
   • CPassive monitoring
   • DPort scanning
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is performing asset discovery in a network segment that contains both managed and unmanaged devices. The analyst has access to an active scanner and a SPAN port for passive monitoring. The network team has reported that some devices are intermittently connected and may not be present during the scan window. What is the most effective discovery strategy?

   • ARun active scans at multiple times and combine them with continuous passive monitoring for a period of time.
   • BUse only passive monitoring because it is non-intrusive and captures all devices over time.
   • CUse only active scanning because it is more reliable than passive monitoring.
   • DRun a single active scan during business hours to capture the maximum number of devices.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which data source is commonly used for traffic flow analysis?

   • ANetFlow or IPFIX records
   • BWindows Event Logs
   • CDNS zone transfers
   • DSyslog messages from routers
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A detection analyst is examining a packet capture and sees a series of TCP SYN packets sent to a single host on port 445, each with a different source IP address. The destination host responds with SYN-ACK packets, but the analyst sees no corresponding ACK packets. What does this pattern most likely indicate?

   • AA SYN flood attack from a single compromised host.
   • BA normal TCP handshake from multiple clients.
   • CA misconfigured load balancer sending health checks.
   • DA distributed port scan using spoofed source addresses.
   Reveal Solution Discussion Select an answer first