Defensive Infrastructure and Tactics GCED Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which network traffic pattern is most likely to indicate a port scan?

   • AA single connection to a web server on port 80
   • BLarge amounts of data transferred from a server to a client
   • CA series of connection attempts to multiple ports on the same host in a short time
   • DRepeated failed login attempts from a single IP address
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network analyst is reviewing packet captures and notices a series of TCP SYN packets sent to multiple ports on a single host from the same source IP, with no subsequent ACK packets. The analyst wants to confirm whether this is a port scan. Which additional observation would most strongly support that conclusion?

   • AThe SYN packets are all the same size and have the same TTL value.
   • BThe source IP has sent SYN packets to the same destination host in the past.
   • CThe source IP is listed in a threat intelligence feed as a known scanner.
   • DThe destination host is a web server that normally receives HTTP traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to detect attackers who are already inside the network and moving laterally. They have deployed a honeypot that emulates a file server with fake credentials and sensitive-looking documents. Which additional action would best complement the honeypot to detect lateral movement?

   • AUse the honeypot's credentials in the real Active Directory to lure attackers.
   • BConfigure alerts for any authentication attempts to the honeypot and correlate them with other network activity.
   • CPlace the honeypot on the same subnet as the real file server to make it more realistic.
   • DDisable logging on the honeypot to avoid alerting attackers.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations center (SOC) receives a threat intelligence feed containing a list of malicious IP addresses and domains. The SOC wants to integrate this feed into their defensive infrastructure to automatically block traffic to these indicators. Which integration approach is most effective and least likely to cause operational disruption?

   • AManually review each indicator and add them to the proxy's blocklist after verification.
   • BBlock the indicators at the DNS server by returning a non-resolving response for the domains.
   • CAdd the indicators to the SIEM as correlation rules and generate alerts when traffic matches.
   • DConfigure the firewall to block all traffic to the listed IP addresses and domains, and update the list daily.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security operations team wants to improve detection of command-and-control (C2) traffic. They have access to a threat intelligence feed that provides domain names and IP addresses associated with known C2 infrastructure. Which integration would provide the most comprehensive detection coverage?

   • AAdd only the IP addresses to the firewall blocklist.
   • BAdd the indicators to both the DNS sinkhole and the firewall blocklist.
   • CAdd only the domain names to the DNS sinkhole.
   • DCreate a SIEM alert for any traffic to the listed IP addresses.
   Reveal Solution Discussion Select an answer first