Network Security Monitoring Concepts and Application GCED Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is reviewing NSM data and notices that a workstation is communicating with a known command-and-control server at regular intervals, but the traffic volume is very low and does not match any known signature. Which analysis technique would be most effective in identifying this behavior?

   • ABehavioral analysis to establish a baseline and identify the periodic communication pattern.
   • BNetFlow analysis to look for high-volume data transfers.
   • CSignature-based detection to match the traffic against known C2 signatures.
   • DFull packet capture analysis to inspect the payload for malicious content.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company needs to retain network activity data for 90 days for compliance, but full packet capture for all traffic is too expensive. They want to preserve the ability to investigate historical security incidents without storing entire packets. Which collection strategy best meets this requirement?

   • AUse a SIEM to collect and store alerts for 90 days
   • BAggregate firewall logs and store them for 90 days
   • CEnable NetFlow export from routers and store flow records for 90 days
   • DCapture full packets only for critical servers and store for 90 days
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a common mitigation strategy for the high volume of false positives in NSM alerts?

   • ADisabling all alerting to avoid distractions
   • BDeleting all log data to reduce analysis workload
   • CIncreasing the number of signatures to catch more threats
   • DTuning detection rules and thresholds to reduce noise
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is deploying NSM for a network that includes both on-premises servers and cloud-hosted applications. They need to monitor traffic between the two environments, but the cloud provider does not allow packet capture on their virtual network. Which approach provides the best visibility into this traffic?

   • AUse cloud provider flow logs and API logs to monitor traffic to and from the cloud applications
   • BDeploy a VPN concentrator on-premises and capture all traffic at that point
   • CRely solely on on-premises firewall logs
   • DUse a cloud-based IDS that requires installing a virtual sensor in the cloud VNet
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A network engineer is setting up NSM collection for a remote site with limited bandwidth. They need to capture full packets for incident investigation but cannot afford to transmit all packets to the central SIEM. Which collection approach balances local retention with central visibility?

   • ASend all NetFlow data to the central SIEM and discard packets locally
   • BDeploy a local sensor that captures full packets and sends only alert-triggered packet excerpts to the central SIEM
   • CStream all full packets to the central SIEM in real time
   • DUse a central sensor that captures packets via remote SPAN over the WAN
   Reveal Solution Discussion Select an answer first