Network and Flow Monitoring GCTD Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A cloud team is configuring VPC flow logs for a production VPC. They want to capture all traffic, but they are concerned about the cost of storing logs. They decide to use a 10-minute aggregation interval. What is the primary trade-off of this decision?

   • ALoss of packet payload data.
   • BInability to filter traffic by port.
   • CReduced granularity for detecting short-lived connections.
   • DIncreased latency in log delivery.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of an anomaly that can be detected by analyzing flow log data?

   • AA sudden increase in traffic to a destination port that is not normally used
   • BA change in the color scheme of a web application
   • CA decrease in CPU utilization on a database server
   • DAn increase in the number of user login failures
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following best describes the role of flow monitoring in cloud security?

   • AIt provides a high-level view of network communications, which helps identify unusual patterns and potential threats
   • BIt captures the full content of every communication for deep forensic analysis
   • CIt is primarily used to enforce network access policies
   • DIt replaces the need for any other network security controls
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is using VPC flow logs to detect a potential brute-force attack against an SSH server. The flow logs show many connections from different source IPs to the same destination port 22. Which analysis approach would best confirm the attack?

   • ALook for large byte counts in the flow logs.
   • BCheck the flow logs for the 'rejected' flag.
   • CCount the number of flow log entries for port 22.
   • DCorrelate the flow logs with the server's authentication logs to see failed login attempts.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the key difference between flow monitoring and packet capture?

   • AFlow monitoring is only used for troubleshooting, while packet capture is used for security
   • BFlow monitoring captures every packet, while packet capture only samples traffic
   • CFlow monitoring records metadata about traffic flows, while packet capture records the actual packet contents
   • DFlow monitoring is performed only on-premises, while packet capture is cloud-only
   Reveal Solution Discussion Select an answer first