Intrusion Detection and Packet Analysis GCED Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company needs to monitor for malicious activity on a network segment that carries traffic between application servers and a database. The traffic is encrypted with TLS. The security team wants to detect attacks that exploit application-layer vulnerabilities, but they cannot decrypt the traffic due to compliance constraints. Which approach is most effective?

   • AConfigure the database to log all queries and review them manually
   • BUse a network TAP and an anomaly-based NIDS to detect deviations in traffic patterns
   • CDeploy a host-based IDS on the application and database servers to monitor system calls and file integrity
   • DDeploy a network-based IDS at the segment's switch mirror port and rely on signature detection
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company wants to monitor wireless network traffic for rogue access points and unauthorized client associations. They already have a network-based IDS on the wired segment. What additional deployment is most appropriate?

   • ADeploy a host-based IDS on all wireless clients
   • BUse a network TAP on the wireless access point's uplink
   • CConfigure the wired NIDS to monitor the wireless controller's traffic
   • DDeploy a wireless IDS (WIDS) with sensors placed throughout the facility
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC is overwhelmed by IDS alerts, many of which are false positives caused by legitimate internal scanning tools. The team wants to reduce alert noise without missing real attacks. They have identified the scanning tool's IP addresses and the time windows when scans run. Which approach is most effective?

   • ARoute all alerts from the scanning tool to a separate low-priority queue
   • BDisable the IDS signatures that the scanning tool triggers
   • CCreate a suppression rule that filters alerts from the scanning tool's IP addresses during the scheduled scan windows
   • DIncrease the alert threshold for all alerts to reduce volume
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is correlating IDS alerts and notices that a series of low-severity alerts, when viewed together, indicate a multi-step attack. The individual alerts are: (1) an unusual outbound connection from a workstation, (2) a spike in DNS queries from the same workstation, and (3) a file integrity alert on the same workstation. What is the best way to handle these correlated alerts?

   • ABlock the workstation's IP address immediately without further analysis
   • BClose each alert individually as low severity because none is critical on its own
   • CWait for more alerts before taking any action
   • DEscalate the correlated set as a single incident for immediate investigation
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is using tcpdump to capture traffic on an interface but is missing packets during high traffic periods. The analyst needs to reduce packet loss. Which action is most effective?

   • ACapture all traffic without a filter to ensure nothing is missed
   • BIncrease the capture buffer size and use a BPF filter to reduce the amount of traffic captured
   • CWrite the capture directly to a slow disk to avoid memory issues
   • DUse a smaller snaplen to capture only the first 64 bytes of each packet
   Reveal Solution Discussion Select an answer first