Network Security Monitoring Concepts and Application GCED Practice Questions (Page 9)

Questions 41–44

1. 41foundation · easy

   What is the primary purpose of Network Security Monitoring (NSM)?

   • ATo enforce organizational security policies by filtering outbound traffic
   • BTo collect and analyze network data to detect and respond to security threats
   • CTo prevent all network attacks by blocking malicious traffic in real time
   • DTo replace traditional antivirus software on endpoint devices
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What type of information is typically found in NetFlow data?

   • AThe full content of email messages
   • BThe text of instant messages
   • CSource and destination IP addresses, ports, and byte counts
   • DThe contents of files transferred over FTP
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company is deploying NSM in a multi-tenant data center where they share physical infrastructure with other tenants. They need to monitor their own virtual machines' network traffic but cannot capture traffic from other tenants. Which deployment approach is most appropriate?

   • APlace a physical tap on the shared physical switch
   • BUse NetFlow export from the shared switch, filtering by their VLAN
   • CDeploy a virtual sensor inside each of their virtual machines
   • DDeploy a sensor at the internet egress of the data center
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security operations center (SOC) is implementing an NSM workflow. The team is receiving a high number of alerts from the IDS, many of which are false positives. The SOC manager wants to reduce alert fatigue while ensuring that true positives are not missed. Which workflow adjustment is most effective?

   • ADisable all IDS signatures that have generated false positives in the past.
   • BAutomatically escalate all alerts to the incident response team.
   • CIncrease the IDS sensitivity to catch more potential threats.
   • DImplement a triage process where analysts validate alerts against multiple data sources before escalating.
   Reveal Solution Discussion Select an answer first