Defensive Infrastructure and Tactics GCED Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A network analyst is reviewing packet captures and notices a large volume of outbound DNS queries from a single internal host to a domain that is only 24 hours old. The queries are occurring every 5 seconds and the responses are small. The analyst checks the threat intelligence feed and finds that the domain is not listed as malicious. What is the most appropriate next step?

   • AImmediately isolate the host from the network and escalate to incident response.
   • BBlock the domain at the firewall and add it to the threat intelligence feed as a confirmed malicious indicator.
   • CInvestigate the host to determine what process is generating the DNS queries and whether the domain is associated with any known application.
   • DIgnore the traffic because the domain is not in the threat intelligence feed, and the analyst should only act on confirmed indicators.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which defensive infrastructure component is specifically designed to filter traffic based on application-layer data and can also provide caching and anonymity for internal clients?

   • AVPN concentrator
   • BNetwork firewall
   • CProxy server
   • DIntrusion detection system
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is an indicator of compromise (IOC)?

   • AA type of firewall rule that blocks malicious traffic
   • BA vulnerability scanner that identifies weaknesses
   • CA security control that prevents unauthorized access
   • DA piece of forensic evidence that suggests a system may have been compromised
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security team is integrating a new threat intelligence feed into their SIEM. The feed contains a high volume of indicators, many of which are low-confidence or have a short lifespan. The team is concerned about alert fatigue and false positives. Which approach is most effective for integrating this feed?

   • AIgnore the feed and rely on existing detection rules.
   • BBlock all indicators in the feed at the firewall, regardless of confidence.
   • CGenerate alerts for all indicators in the feed to ensure no threat is missed.
   • DUse the feed to generate alerts only for high-confidence indicators, and use low-confidence indicators for enrichment and context.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security architect is designing a defense-in-depth strategy for a web application. The application is critical and must remain available, but the organization has experienced targeted attacks. The architect wants to add deception and monitoring capabilities without impacting performance. Which combination of controls is most balanced?

   • ADeploy a WAF, a honeypot in a separate network, and network monitoring on the application's traffic.
   • BDeploy a WAF and rely on its logs for monitoring, without any deception.
   • CDeploy network monitoring and a honeypot, but no WAF, to avoid performance impact.
   • DDeploy a honeypot in front of the application and disable logging to improve performance.
   Reveal Solution Discussion Select an answer first