Defensive Infrastructure and Tactics GCED Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How does layering multiple defensive mechanisms enhance overall network security?

   • AIt allows all security devices to be managed from a single console
   • BIt ensures that no single point of failure can compromise the entire network
   • CIt eliminates the need for continuous monitoring and updates
   • DIt makes the network faster by reducing the number of security checks
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is reviewing alerts from the SIEM and notices that a workstation has been making connections to a known malicious IP address. The IP address is listed in the threat intelligence feed. The analyst also notices that the workstation has been sending large amounts of data to the IP address. What is the most appropriate immediate action?

   • ABlock the IP address at the firewall and continue monitoring the workstation.
   • BIsolate the workstation from the network and begin a forensic investigation.
   • CIgnore the alert because the IP address is in the threat intelligence feed, and the analyst should only act on confirmed indicators.
   • DAdd the IP address to the threat intelligence feed as a confirmed malicious indicator and move on.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A small e-commerce company wants to protect its web application from common attacks. They currently have a firewall and an IDS. The security team wants to add another layer of defense without significant infrastructure changes. Which addition would most effectively enhance defense-in-depth for the web application?

   • ADisable the firewall's logging to improve performance.
   • BMove the web server to a different hosting provider.
   • CIncrease the IDS sensitivity to catch more alerts.
   • DDeploy a web application firewall (WAF) in front of the web server to filter HTTP traffic.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A manufacturing company's IT team is redesigning the network to better protect the production control system (PCS) from malware that might enter through the corporate email system. The PCS must remain reachable by a small group of engineers from the corporate LAN, but no other corporate users should be able to reach it. The team has a limited budget and wants to minimize changes to existing endpoints. Which approach best meets these requirements?

   • ADeploy an IPS in front of the PCS and configure it to block malware signatures, while leaving the network topology unchanged.
   • BMove the PCS to the DMZ and allow all corporate LAN users to access it through a VPN.
   • CInstall a host-based firewall on each engineer's workstation and rely on the existing flat network to keep the PCS isolated.
   • DPlace the PCS in a separate VLAN with a firewall rule that allows only the engineers' IP addresses to access it from the corporate LAN.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security architect is designing a defense-in-depth strategy for a critical application. The application is internet-facing and processes sensitive customer data. The architect wants to ensure that even if the application is compromised, the attacker cannot easily pivot to the internal network. Which combination of controls provides the most effective defense-in-depth?

   • AA DMZ that contains the application, a firewall that blocks all traffic from the DMZ to the internal network, and a host-based intrusion detection system (HIDS) on the application server.
   • BA web application firewall (WAF) in front of the application, a network-based IPS, and a honeypot on the internal network.
   • CA firewall that only allows traffic to the application on port 443, and a VPN for all administrative access.
   • DA single firewall with a rule that allows all traffic from the internet to the application, and a network tap for monitoring.
   Reveal Solution Discussion Select an answer first