Defensive Infrastructure and Tactics GCED Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company's intrusion detection system (IDS) alerts on suspicious outbound traffic from a finance department workstation to an external IP. The workstation user is currently logged in and working. The incident response team needs to contain the potential compromise while minimizing business disruption. Which action is the most appropriate initial containment step?

   • AAsk the user to close all applications and disconnect from the network themselves.
   • BIgnore the alert because the user is actively working and the traffic might be legitimate.
   • CIsolate the workstation by blocking its network access at the switch port, then investigate the alert.
   • DPower off the workstation immediately to stop all activity.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is deploying a new remote access solution for its employees. The employees will work from home and need to access internal applications. The security team wants to ensure that all remote access traffic is encrypted and that only authorized employees can connect. Which defensive infrastructure component is most appropriate for this requirement?

   • AA web proxy with URL filtering.
   • BA firewall with a rule that allows all traffic from the internet to the internal network.
   • CA network-based intrusion detection system (IDS).
   • DA virtual private network (VPN) concentrator with multi-factor authentication.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security architect is designing a defense-in-depth strategy for a large enterprise. The enterprise has a mature security operations center (SOC) and a threat intelligence team. The architect wants to implement a deception layer to detect attackers who have bypassed other controls. Which approach is most effective for this purpose?

   • ADeploy a honeypot on the DMZ that emulates a web server, and do not integrate it with the SOC.
   • BDeploy a single honeypot on the internal network that emulates a database server.
   • CUse a network tap to monitor all traffic and rely on the SOC to identify anomalies.
   • DDeploy a honeynet with multiple honeypots that emulate different services, and integrate them with the threat intelligence team's processes.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary purpose of placing publicly accessible servers in a DMZ?

   • ATo simplify firewall rules by allowing all traffic to the internal network
   • BTo isolate them from the internal network while still providing controlled access from the internet
   • CTo allow direct access to internal databases from the internet
   • DTo improve the performance of public servers by placing them closer to users
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security team is deploying a honeynet to detect and analyze attacker behavior. The honeynet consists of several honeypots that emulate different services. The team wants to ensure that the honeynet does not become a launching point for attacks against production systems. Which control is most important to prevent this?

   • AUse a network tap to monitor all traffic to and from the honeynet.
   • BConfigure the honeypots to emulate only low-value services, such as FTP and Telnet.
   • CPlace the honeynet on a separate network segment with a firewall that blocks all outbound traffic from the honeynet to production systems.
   • DConfigure the honeypots to log all traffic and integrate with the SIEM.
   Reveal Solution Discussion Select an answer first