Defensive Infrastructure and Tactics GCED Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large organization is planning a network redesign to improve security. The security team wants to segment the network to limit lateral movement, but the operations team is concerned that strict segmentation will hinder troubleshooting and increase complexity. The organization has a compliance requirement to protect cardholder data (PCI DSS). Which approach best balances security and operational needs?

   • AKeep the network flat to simplify troubleshooting and rely on endpoint security controls.
   • BSegment only the PCI systems and leave all other systems on a flat network.
   • CImplement a tiered segmentation model with a separate PCI zone, internal zones, and a DMZ, and use firewall rules to allow only necessary traffic between zones.
   • DUse a single firewall between the internal network and the internet, with no internal segmentation.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company has detected a malware infection on a server in the DMZ. The malware is communicating with an external command-and-control (C2) server. The incident response team has isolated the server by disconnecting it from the network. What is the next step in the incident response process?

   • ANotify law enforcement and the media about the incident.
   • BReimage the server and restore data from backups, but do not investigate the root cause.
   • CConduct a lessons-learned review to identify improvements to the security posture.
   • DEradicate the malware from the server and restore it to a known good state.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does network segmentation limit lateral movement during an attack?

   • ABy increasing the number of open ports between segments
   • BBy restricting the paths an attacker can take to reach other systems
   • CBy encrypting all traffic between segments
   • DBy monitoring all user activity in real time
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst at a financial firm wants early warning of an attacker probing the internal network. The firm has a production network with real servers and a separate lab network. The analyst wants to deploy a system that will attract and log attacker activity without risking production systems. Which deployment best fits this goal?

   • ACreate a fake user account in Active Directory and monitor for login attempts with that account.
   • BConfigure the production firewall to log all denied inbound connections and review the logs weekly.
   • CInstall a network tap on the production core switch and feed all traffic to a SIEM for analysis.
   • DPlace a honeypot in the lab network that emulates a database server and log all connection attempts to it.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   During an incident, a critical database server is infected with ransomware that is encrypting files and spreading to other servers. The incident response team must contain the outbreak, but the database is used by a live application that cannot be taken offline for more than a few minutes. Which containment strategy is most effective?

   • ADisconnect only the database server's connection to the application, but leave it connected to the internal network.
   • BAllow the ransomware to finish encrypting the database, then restore from backup.
   • CIsolate the database server from the network immediately, then restore from a recent backup and patch the vulnerability.
   • DShut down the database server and immediately bring it back online after removing the ransomware file.
   Reveal Solution Discussion Select an answer first