Network Defenses GDSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is experiencing frequent false positives from its IPS, causing legitimate traffic to be blocked. The security team wants to reduce false positives while maintaining the ability to block real attacks. Which approach is most effective?

   • ATune the IPS signatures to match the specific applications and traffic patterns used in the environment.
   • BDisable the IPS and rely on the firewall to block malicious traffic.
   • CIncrease the sensitivity of the IPS signatures to catch more attacks.
   • DSet the IPS to alert-only mode so it does not block any traffic.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is investigating a security incident. They have firewall logs, IDS alerts, and VPN logs. They need to determine if a remote user's VPN session was used to access a sensitive internal server. Which combination of logs is most useful?

   • AVPN logs to identify the user and session, and firewall logs to see the traffic from the VPN IP to the internal server.
   • BIDS alerts only, because they show all malicious activity.
   • CVPN logs only, because they show the user's activity.
   • DFirewall logs only, because they show all network traffic.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A university wants to isolate its student lab network from the administrative network to prevent students from accessing sensitive administrative systems. Which approach is most effective?

   • AUse a single firewall rule that allows all traffic between the two networks, but log all traffic.
   • BUse VLANs to separate the student lab and administrative networks, and configure firewall rules to block traffic between them.
   • CDeploy an IDS on the student lab network to detect unauthorized access attempts.
   • DPlace all devices on the same VLAN and rely on host-based firewalls to protect administrative systems.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which statement accurately describes how an IPS responds to detected malicious network activity?

   • AIt quarantines the entire network segment to prevent any further activity
   • BIt automatically blocks or drops the traffic based on configured rules and signatures
   • CIt only reports the activity to a SIEM for later analysis
   • DIt records the activity in a log and sends an alert to the security team, but does not affect the traffic
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is redesigning its network to isolate the finance department from the rest of the corporate LAN. The finance team must access the internet and a central ERP system, but no other department should be able to initiate connections into the finance subnet. The security team wants to enforce this with a stateful firewall. Which configuration best meets the requirement?

   • APlace a stateless ACL on the core switch that blocks all traffic to the finance subnet except from the ERP server's IP address.
   • BPlace a stateful firewall between the finance subnet and the core switch, with rules allowing outbound traffic from finance and permitting only established return traffic, plus a specific allow rule for the ERP system.
   • CConnect the finance subnet to the same VLAN as the ERP system and rely on host-based firewalls on finance workstations to block unwanted inbound connections.
   • DDeploy an IPS in inline mode on the finance subnet's uplink and configure it to drop any packets with a destination IP in the finance range.
   Reveal Solution Discussion Select an answer first