Network and Flow Monitoring GCTD Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is reviewing flow logs from an AWS load balancer and notices a high number of requests from a single IP address to a specific endpoint, with each request lasting only a few milliseconds. The analyst also sees that the load balancer returned HTTP 404 errors for these requests. What is the most likely explanation?

   • AA DDoS attack overwhelming the load balancer
   • BA web application scanner probing for vulnerabilities
   • CA misconfigured client retrying a failed request
   • DA legitimate user refreshing a page multiple times
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is integrating VPC flow logs with their SIEM. They want to enrich the flow logs with threat intelligence to identify connections to known malicious IPs. Which approach is most effective?

   • AUse the flow log's built-in threat detection feature.
   • BManually compare flow logs to a static list of malicious IPs.
   • CUse a SIEM enrichment feature that matches flow log source/destination IPs against threat intelligence feeds.
   • DStore threat intelligence in the flow log destination bucket.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst needs to detect a potential data exfiltration pattern where an internal host is sending large volumes of data to an external IP over HTTPS. The analyst has access to both VPC flow logs and full packet captures from a network tap. The investigation must be completed quickly, and the analyst needs to identify the top talkers and total bytes transferred per connection over the last 24 hours. Which approach is most efficient for this task?

   • AOpen the packet captures in a protocol analyzer and filter for HTTPS traffic to the external IP.
   • BUse the packet captures to reconstruct the HTTPS sessions and decrypt the traffic.
   • CQuery the VPC flow logs to aggregate bytes and packets by destination IP and port.
   • DEnable a new flow log with a 1-minute capture interval and wait 24 hours to collect data.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security engineer is troubleshooting why VPC flow logs are not appearing in the SIEM. The flow logs are enabled and delivered to an S3 bucket, but the SIEM collector is not ingesting them. The engineer has verified that the S3 bucket has new files and the SIEM collector has read permissions. What is the next most likely cause to investigate?

   • AThe S3 bucket is in a different region than the SIEM.
   • BThe flow logs are in a compressed format that the SIEM cannot parse.
   • CThe flow log aggregation interval is set to 10 minutes, so logs are delayed.
   • DThe SIEM collector is not configured to watch the correct S3 bucket path or prefix.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security architect is designing a network monitoring solution for a hybrid cloud environment. The environment includes on-premises data centers connected to AWS via a VPN. The architect needs to detect malicious traffic that may be traversing the VPN tunnel. Which data sources should be used?

   • AOnly VPC Flow Logs, because they capture all traffic including VPN traffic
   • BAWS CloudTrail logs for the VPN connection
   • COnly on-premises firewall logs, because they capture all traffic before it enters the VPN
   • DVPC Flow Logs for the VPC and VPN tunnel metrics from CloudWatch
   Reveal Solution Discussion Select an answer first