Intrusion Detection and Packet Analysis GCED Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is using Wireshark to investigate a slow network connection. The analyst suspects packet loss is occurring. Which display filter or statistic would best confirm packet loss?

   • AFilter on 'dns.flags.response == 0'
   • BFilter on 'http.response.code == 500'
   • CFilter on 'tcp.flags.syn == 1'
   • DFilter on 'tcp.analysis.retransmission'
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which statement best describes the role of intrusion detection in a layered defense-in-depth architecture?

   • AIt provides a monitoring layer that detects activity that other controls may have missed
   • BIt is the primary mechanism for preventing unauthorized access
   • CIt eliminates the need for log management and SIEM tools
   • DIt guarantees that all attacks are identified in real time
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   An organization has a NIDS that is generating a high volume of alerts for a specific signature. The analyst discovers that the alerts are triggered by a legitimate internal application that uses a custom protocol. The analyst needs to reduce false positives without losing visibility into actual attacks. Which approach is most effective?

   • AIncrease the threshold for the signature so that it only triggers on higher traffic volumes.
   • BCreate a whitelist rule to suppress alerts for the specific application's IP addresses and ports.
   • CSwitch the IDS to anomaly-based detection to avoid signature-specific false positives.
   • DDisable the specific signature that is causing the false positives.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is reviewing a packet capture and notices a large volume of UDP traffic from an internal host to an external IP on port 53. The DNS queries are for random subdomains of a single domain that does not appear in any legitimate business records. What is the most likely explanation?

   • AThe host is tunneling data through DNS queries
   • BThe host is performing a DNS zone transfer
   • CThe host is experiencing a DNS cache poisoning attack
   • DThe host is running a recursive DNS resolver
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a primary weakness of signature-based intrusion detection?

   • AIt generates a high number of false positives on normal traffic
   • BIt is unable to inspect encrypted traffic
   • CIt requires a baseline of normal behavior to operate
   • DIt cannot detect attacks that do not match a known signature
   Reveal Solution Discussion Select an answer first