Network Security Monitoring Concepts and Application GCED Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst notices a series of failed login attempts from a single IP address against the company's VPN gateway, followed by a successful login and then large data transfers to an external server. Which NSM analysis technique would be most effective in identifying this as a potential attack?

   • AAnalyzing full packet capture to look for malformed packets.
   • BReviewing NetFlow records for the total volume of traffic.
   • CCorrelating authentication logs with flow data to identify the sequence of events.
   • DRunning signature-based detection on the VPN traffic to match known attack patterns.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of log aggregation in NSM data collection?

   • ATo combine logs from multiple sources into a central repository for analysis
   • BTo replace the need for intrusion detection systems
   • CTo capture raw network packets for forensic analysis
   • DTo block malicious traffic based on log entries
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An organization is establishing an NSM workflow. The security team has deployed sensors and is collecting full packet capture and logs. They are now defining the process for handling alerts. According to the NSM workflow, what should occur immediately after an alert is generated?

   • AThe analyst should update the IDS signatures to prevent future alerts.
   • BThe analyst should validate the alert to determine if it is a true positive.
   • CThe incident response team should be activated immediately.
   • DThe analyst should delete the alert if it matches a known false positive.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An organization is choosing between a commercial SIEM and an open-source NSM platform. They have a small security team with limited scripting skills and need to meet a 30-day deployment deadline. Which factor should most heavily influence their decision?

   • AThe total cost of ownership over five years
   • BThe availability of vendor support and out-of-the-box integrations
   • CThe number of data sources supported by each platform
   • DThe open-source platform's flexibility for custom analytics
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is deploying network security monitoring at a remote branch office with a 100 Mbps internet link. The security team wants to capture full packets for all traffic crossing the internet boundary. The branch has a single firewall that handles all traffic. Which deployment approach is most appropriate?

   • AConfigure the firewall to mirror all traffic to the sensor using SPAN on the internal switch.
   • BUse NetFlow export from the firewall instead of full packet capture to reduce storage requirements.
   • CInstall the sensor inline between the firewall and the internal switch.
   • DPlace a network TAP between the ISP router and the firewall and connect the sensor to the TAP.
   Reveal Solution Discussion Select an answer first