IDS Fundamentals and Network Architecture GCIA Practice Questions (Page 8)

Questions 36–38

1. 36expert · hard

   A company is designing a new network segment for a high-security research lab. The lab must be monitored for both inbound and outbound traffic, but the network team is concerned about introducing a single point of failure. They are considering whether to place the NIDS sensor inline or use a SPAN port. Which consideration is most important when deciding between inline and passive (SPAN) deployment?

   • AInline deployment is always more secure because it can drop malicious packets
   • BPassive deployment is easier to manage because it does not require a network tap
   • CPassive deployment provides better visibility because it can see encrypted traffic
   • DInline deployment can block traffic, which may introduce a single point of failure, while passive deployment does not affect traffic flow
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is deploying intrusion detection across its environment. The network team wants to monitor traffic between internal systems, and the security team wants to detect malicious activity on individual workstations, including attempts to modify local files. The company has a limited budget and wants to use a single type of IDS that can address both requirements. Which approach best satisfies both needs?

   • ADeploy a hybrid IDS that combines network sensors and host agents
   • BDeploy a network-based IDS at the core switch
   • CDeploy a host-based IDS on each workstation
   • DDeploy a network-based IDS at the internet edge only
   Reveal Solution Discussion Select an answer first
3. 38application · medium

   An analyst notices that a database server regularly receives a large number of small TCP connections from a specific internal application server. Over the past week, the connection rate has tripled, and each connection transfers only a few bytes. The analyst wants to determine whether this is a new normal behavior or an anomaly. Which approach is most appropriate?

   • ADisable the database server's network interface to stop the traffic
   • BImmediately block the application server's IP address at the firewall
   • CCompare the current traffic pattern to historical flow records and baseline metrics
   • DEnable signature-based detection on the database server's HIDS
   Reveal Solution Discussion Select an answer first