Asset and Network Analytics GCDA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A detection analyst has established a baseline for a database server that normally receives about 100 queries per minute from a specific application server. The analyst observes a sudden increase to 10,000 queries per minute from the same application server. Which action should the analyst take first?

   • AVerify whether the increase is legitimate by checking application logs and recent changes.
   • BImmediately block the application server's IP address at the firewall.
   • CIncrease the baseline threshold to reduce future false positives.
   • DIgnore the alert because the source is a known application server.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is typically represented in a network topology map?

   • AThe connections between network devices and hosts
   • BThe contents of every database
   • CThe personal preferences of users
   • DThe operating system version of every endpoint
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which protocol is used to resolve domain names to IP addresses and is often abused for data exfiltration or DNS tunneling?

   • AFTP
   • BDNS
   • CARP
   • DICMP
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A large organization is classifying assets for monitoring priority. The assets include a domain controller, a file server containing sensitive HR data, a public web server, and a development server. The organization has limited monitoring resources and must prioritize. The domain controller is in a highly restricted administrative network, the file server is accessible to all employees, the web server is internet-facing, and the development server is isolated. Which asset should receive the highest monitoring priority?

   • AThe domain controller, because it is the most critical asset.
   • BThe public web server, because it is internet-facing.
   • CThe file server, because it contains sensitive data and is accessible to many users.
   • DThe development server, because it is isolated and may have weaker controls.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A detection analyst is integrating a new threat intelligence feed that contains a large number of IP addresses. The analyst notices that many of the IPs are cloud provider ranges and are frequently used by legitimate services. Which approach would best reduce false positives while still detecting malicious activity?

   • AAutomatically block all IPs in the feed at the firewall.
   • BCreate alerts for any traffic to or from any IP in the feed.
   • CUse the feed to enrich alerts and prioritize matches that also correlate with other suspicious behavior.
   • DExclude all cloud provider IPs from the feed.
   Reveal Solution Discussion Select an answer first