IDS Fundamentals and Network Architecture GCIA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which detection methodology relies on predefined patterns of known attacks?

   • AAnomaly-based detection
   • BSignature-based detection
   • CStateful protocol analysis
   • DHeuristic analysis
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which network location provides the best coverage for detecting internal reconnaissance and lateral movement?

   • AOnly on the DMZ
   • BOnly on the management network
   • CInternal network segments, such as between departments or server zones
   • DInternet-facing perimeter
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which data source is most useful for correlating IDS alerts with user activity on a specific host?

   • ANetFlow records
   • BRouter configuration files
   • CPacket captures
   • DHost system logs
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is reviewing flow records and notices that a database server, which normally communicates with only a small set of application servers, is now sending large amounts of data to an external IP address during off-hours. The flow records show the connection is using port 443. The analyst must determine whether this is a legitimate backup to a cloud service or data exfiltration. Which combination of actions would provide the most conclusive evidence?

   • ACompare the traffic volume to historical backup patterns and check the server's scheduled tasks
   • BCheck the destination IP against threat intelligence and review the server's outbound proxy logs
   • CBlock the external IP address and monitor for further attempts
   • DCapture and decrypt the TLS traffic using the server's private key
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An organization has a NIDS that uses signature-based detection and a HIDS that uses anomaly-based detection. The NIDS generates a high volume of alerts for a known exploit, but the HIDS has not generated any alerts for the same activity. The analyst suspects the exploit is being obfuscated to evade the NIDS. Which action would best help confirm this?

   • ASwitch the NIDS to anomaly-based detection
   • BIncrease the sensitivity of the HIDS anomaly detection
   • CDisable the NIDS signature that is generating the alerts
   • DCompare the NIDS alert payloads with the HIDS logs to see if the exploit reached the host
   Reveal Solution Discussion Select an answer first