IDS Fundamentals and Network Architecture GCIA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company has a network with a perimeter firewall, an internal core switch, and several departmental switches. The security team wants to monitor both inbound traffic from the internet and lateral movement between internal departments. They have a limited number of NIDS sensors. Which placement strategy provides the best coverage for both requirements?

   • APlace one sensor on the core switch only
   • BPlace one sensor on each departmental switch
   • CPlace one sensor on the internet-facing side of the firewall
   • DPlace one sensor between the firewall and the core switch, and another on the core switch monitoring inter-departmental traffic
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which traffic flow characteristic is most useful for detecting a potential data exfiltration attempt?

   • AA change in the source MAC address of internal hosts
   • BA decrease in inbound web traffic
   • CA sudden increase in outbound traffic volume to an external destination
   • DAn increase in DNS queries to internal servers
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is a key advantage of anomaly-based detection over signature-based detection?

   • AIt requires no training data
   • BIt produces fewer false positives
   • CIt is easier to tune and maintain
   • DIt can detect previously unknown attacks
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization's NIDS uses signature-based detection and has missed a new, previously unseen attack that exploited a vulnerability in a custom application. The security team wants to improve detection of such novel attacks without significantly increasing false positives. Which additional detection method would best address this gap?

   • AIncreasing the sensitivity of existing signatures
   • BDeploying a second signature-based IDS from a different vendor
   • CStateful protocol analysis that validates protocol compliance
   • DAnomaly-based detection that models normal application traffic patterns
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst is investigating a potential data exfiltration incident. The NIDS logs show that a large amount of data was transferred from an internal server to an external IP address over a short period. The analyst needs to determine the exact content of the data that was transferred. Which data source would provide this information?

   • AThe firewall's connection log
   • BThe server's authentication logs
   • CFull packet capture of the session
   • DNetFlow records for the session
   Reveal Solution Discussion Select an answer first