Network Security Monitoring Concepts and Application GCED Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator needs to monitor traffic flows between multiple subnets to identify which systems are communicating and to detect unusual traffic patterns. The administrator does not need to inspect packet contents. Which collection method is most appropriate?

   • ADeploy full packet capture sensors on each subnet.
   • BUse an IDS with signature detection on the core switch.
   • CEnable NetFlow export on the core switches and collect the data in a flow collector.
   • DConfigure syslog aggregation from all servers.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which tool is specifically designed to analyze individual network packets?

   • ASnort
   • BWireshark
   • CSplunk
   • DNessus
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst needs to perform a deep dive on a specific network conversation to extract files that were transferred. The analyst has access to a SIEM, a flow collector, and a packet analyzer. Which tool should the analyst use to extract the files?

   • AAn IDS console to replay the traffic.
   • BThe flow collector to view the flow records for the conversation.
   • CThe SIEM to search for the file transfer logs.
   • DA packet analyzer, such as Wireshark, to reassemble the session and extract files.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is investigating a potential data exfiltration incident. The NSM data shows a workstation sending large amounts of data to a cloud storage service over HTTPS. The analyst has full packet capture, NetFlow, and proxy logs. Which combination of data sources would provide the most conclusive evidence of the data content being exfiltrated?

   • AFull packet capture alone, assuming the traffic is not encrypted
   • BFull packet capture and the proxy's TLS interception logs
   • CNetFlow records and firewall logs
   • DProxy logs and DNS logs
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is evaluating NSM tools for a network that carries sensitive healthcare data. They must comply with regulations requiring audit logs of access to protected data. Which NSM capability is most directly required to meet this compliance need?

   • AFull packet capture of all network traffic
   • BLog aggregation and retention of authentication and access events
   • CAnomaly detection to identify unusual access patterns
   • DSignature-based IDS to detect known attacks
   Reveal Solution Discussion Select an answer first