Network Security Monitoring Concepts and Application GCED Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization is implementing NSM for the first time. The security team has limited resources and needs to prioritize which data sources to collect. The primary goal is to detect lateral movement and data exfiltration. Which data source should be prioritized?

   • AFull packet capture at the network perimeter and internal segmentation points.
   • BSyslog logs from all servers and endpoints.
   • CDNS logs from the internal DNS server.
   • DNetFlow data from all routers and switches.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst needs to investigate a suspected data exfiltration that occurred over a period of several hours. The organization's NSM platform currently stores only NetFlow records and firewall logs. The analyst needs to reconstruct the actual payload of the suspicious HTTPS sessions. What is the most practical limitation the analyst will face with the current data sources?

   • ANetFlow records do not contain the payload content, so the analyst cannot reconstruct the HTTPS session data.
   • BFirewall logs will contain the full HTTPS payload if the firewall is configured for SSL inspection.
   • CNetFlow records include the full packet payload when flow export is set to version 9.
   • DThe analyst can reconstruct the payload from firewall logs because they contain the raw TCP segments.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An analyst is reviewing NSM data and notices a workstation making repeated connections to an internal file server at odd hours, transferring large amounts of data. The workstation's user is on vacation. Which combination of NSM data sources would best confirm whether this is a compromised account or a misconfigured backup job?

   • ANetFlow and firewall logs
   • BFlow data and authentication logs
   • CFull packet capture and DNS logs
   • DSIEM alerts and IDS signatures
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization is experiencing a high rate of false positives from its network IDS, causing analyst fatigue. The IDS is placed on the internal network segment and is seeing legitimate internal application traffic that triggers signatures. Which mitigation strategy would be most effective?

   • AIncrease the sensitivity of the IDS to catch more potential threats.
   • BReplace the IDS with a full packet capture system.
   • CTune the IDS signatures and create allowlists for known benign internal traffic.
   • DMove the IDS to the external perimeter to reduce internal traffic visibility.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An organization is evaluating NSM tools. They have a mix of on-premises and cloud infrastructure. The security team wants a single tool that can collect logs from cloud services, on-premises servers, and network devices, and provide real-time alerting. Which tool category best fits this requirement?

   • AA flow collector that supports NetFlow from cloud and on-premises devices.
   • BA network TAP with packet capture capabilities.
   • CAn endpoint detection and response (EDR) tool.
   • DA SIEM with cloud and on-premises log collection capabilities.
   Reveal Solution Discussion Select an answer first