Defensive Infrastructure and Tactics GCED Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network administrator notices a large volume of outbound traffic from a single workstation to an IP address in a foreign country during non-business hours. The workstation is a standard user machine and the user is on vacation. The administrator wants to determine if this is malicious. Which action is the most appropriate first step?

   • AImmediately block the workstation's network access and disconnect it from the network.
   • BRun a full antivirus scan on the workstation and wait for the results.
   • CReview the firewall logs to see if the destination IP has been accessed by other users.
   • DCheck the destination IP against threat intelligence feeds and review the workstation's recent process execution logs.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team wants to integrate a commercial threat intelligence feed into their existing security infrastructure. The feed provides IP addresses, domains, and file hashes associated with known malicious activity. The team's primary goal is to reduce the number of false positives in their alerting system while still detecting known threats. Which integration approach is most effective?

   • AImport the entire feed into the SIEM and create alerts for any match against the feed.
   • BConfigure the firewall to block all IP addresses in the feed, and the proxy to block all domains in the feed.
   • CImport the feed into a threat intelligence platform (TIP) and use it to enrich alerts, but only alert when the indicator is observed in conjunction with other suspicious activity.
   • DImport only the file hashes into the endpoint detection and response (EDR) tool and block execution of those hashes.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a security incident, a server in the DMZ is observed sending large amounts of data to an external IP. The incident response team needs to stop the data exfiltration while preserving evidence for later analysis. Which action should be taken first?

   • ARun a network packet capture on the DMZ switch to record all traffic from the server.
   • BShut down the server gracefully and then copy the hard drive for analysis.
   • CDisconnect the server's network cable and take a memory image of the server.
   • DBlock the external IP in the firewall and continue monitoring the server's traffic.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A small business is setting up a new office network. The business has a single internet connection and needs to provide internet access to 20 employees. The owner is concerned about employees accessing malicious websites and wants to ensure that all outbound web traffic is filtered. Which defensive infrastructure component is most appropriate for this requirement?

   • AA network-based intrusion detection system (IDS) placed inline with the internet connection.
   • BA virtual private network (VPN) concentrator for remote access.
   • CA web proxy that requires authentication and enforces URL filtering policies.
   • DA network tap connected to the internet link for monitoring purposes.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement accurately describes a honeynet?

   • AA network segment that only allows outbound traffic
   • BA network of honeypots that simulates an entire network to attract and study attackers
   • CA network that is completely isolated from the internet
   • DA network that uses only open-source security tools
   Reveal Solution Discussion Select an answer first