Network and Flow Monitoring GCTD Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a typical method for sending flow log data to a centralized monitoring platform?

   • ASending the logs via email to the security team
   • BManually copying log files to a USB drive and uploading them to the SIEM
   • CPrinting the logs and scanning them into the monitoring system
   • DStreaming the logs to a message queue or event hub that the monitoring platform consumes
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is investigating a suspected data exfiltration where an internal host is sending large amounts of data to an external IP. They have both VPC flow logs and packet captures available. The team needs to determine the exact content of the data being exfiltrated. Which approach is most appropriate?

   • AUse the VPC flow logs to identify the total bytes transferred.
   • BUse the flow logs to determine the protocol used.
   • CUse the packet captures to reconstruct the sessions and inspect the payloads.
   • DUse the flow logs to identify the destination IP and port.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team is using a third-party SIEM and wants to ingest VPC Flow Logs from AWS. They have enabled flow logs and are publishing them to an S3 bucket. What is the most efficient way to get the flow logs into the SIEM?

   • AUse an S3 event notification to trigger a Lambda function that processes and forwards the logs to the SIEM
   • BManually download the flow log files from S3 and upload them to the SIEM on a schedule
   • CUse AWS CloudTrail to deliver flow logs to the SIEM
   • DEnable flow logs to be delivered directly to the SIEM via S3
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is it beneficial to integrate flow log data with a centralized SIEM tool?

   • AIt provides a direct way to block malicious traffic in real time
   • BIt replaces the need for any other security monitoring tools
   • CIt enables aggregation and correlation of flow data with other security events for more effective alerting
   • DIt automatically patches vulnerabilities in the network infrastructure
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is reviewing VPC Flow Logs and notices a large number of flows from a single internal IP to many different external IP addresses on port 22, each with a small number of packets and bytes. The analyst also sees that most of these flows have a 'REJECT' status. What is the most likely interpretation of this pattern?

   • AA misconfigured DNS resolver sending queries to multiple external servers
   • BA port scan or SSH brute-force attempt originating from the internal IP
   • CA legitimate software update process checking multiple mirrors
   • DNormal load-balanced traffic distribution across multiple web servers
   Reveal Solution Discussion Select an answer first