Network Security Monitoring Concepts and Application GCED Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key characteristic of anomaly-based detection in NSM?

   • AIt requires manual review of every network packet
   • BIt blocks all traffic that does not match a signature
   • CIt relies on a database of known attack signatures
   • DIt compares current activity to a baseline of normal behavior
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which activity is a core function of Network Security Monitoring?

   • AInstalling antivirus software on user workstations
   • BAnalyzing network traffic to identify potential security incidents
   • CConfiguring firewall rules to block malicious IP addresses
   • DDesigning network cabling and physical infrastructure
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An analyst is investigating a potential data breach. The NSM data shows a large outbound transfer from a database server to an external IP. The transfer occurred over a 30-minute period. The analyst has full packet capture, NetFlow, and server logs. Which combination of data sources would provide the most conclusive evidence of data exfiltration?

   • AFull packet capture to reconstruct the transferred data and server logs to confirm the database query that initiated the transfer.
   • BNetFlow records to show the volume and duration of the transfer.
   • CFull packet capture alone to show the destination IP.
   • DServer logs alone to show the database query.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which NSM data source provides the most detailed information about the contents of a network conversation?

   • AFull packet capture
   • BDNS query logs
   • CSystem event logs
   • DNetFlow records
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is monitoring a network segment that carries encrypted traffic using TLS. The team wants to detect malicious activity within the encrypted sessions without decrypting the traffic. Which approach is most effective?

   • AUse flow data and TLS metadata, such as server name indication (SNI) and certificate information, to identify suspicious destinations.
   • BDeploy an IDS with SSL decryption capabilities using a trusted certificate.
   • CRely on NetFlow alone to detect the encrypted traffic.
   • DPerform full packet capture and inspect the encrypted payload for signatures.
   Reveal Solution Discussion Select an answer first