Asset and Network Analytics GCDA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the purpose of establishing a network baseline?

   • ATo set a standard of normal network behavior for comparison in anomaly detection
   • BTo replace the need for security policies
   • CTo automatically block all suspicious traffic
   • DTo ensure all devices have the same configuration
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An analyst is investigating a potential compromise. The analyst sees a firewall log showing outbound connections from an internal workstation to a known malicious IP on port 443. The analyst also sees a DNS log showing a query for a domain that resolves to that IP. What is the most appropriate next step?

   • AIgnore the activity because the connection is encrypted on port 443.
   • BBlock the malicious IP at the firewall and close the case.
   • CConclude that the workstation is compromised and reimage it immediately.
   • DCorrelate the firewall and DNS logs with endpoint detection logs and threat intelligence to confirm the activity and scope.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A detection analyst is investigating a series of alerts. The analyst has the following data: an authentication log showing a successful login from a foreign IP address, a NetFlow record showing a large data transfer from the same workstation to that IP, and a threat intelligence feed that lists the IP as a known command-and-control server. Which action is most appropriate?

   • ARun a vulnerability scan on the workstation to check for weaknesses.
   • BDisable the user's account and block the IP at the firewall.
   • CIgnore the alert because the login was successful and the user may have been traveling.
   • DCorrelate the authentication log, NetFlow record, and threat intelligence to confirm the incident and then escalate.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which factor is most important when prioritizing vulnerability remediation?

   • AThe risk posed by the vulnerability to the organization
   • BThe alphabetical order of the vulnerability name
   • CThe age of the vulnerability
   • DThe number of characters in the CVE ID
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary purpose of asset vulnerability assessment?

   • ATo enforce access control policies
   • BTo map the network topology
   • CTo identify known vulnerabilities and prioritize remediation based on risk
   • DTo monitor real-time traffic
   Reveal Solution Discussion Select an answer first