Network Defenses GDSA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company is designing a new DMZ for public-facing web servers. The security architect wants to apply the principle of least privilege and default deny. Which firewall rule set best reflects these principles?

   • AAllow inbound HTTPS to the web servers from the internet, allow outbound updates from the web servers to specific patch servers, and deny all other traffic.
   • BAllow inbound HTTPS and SSH to the web servers for administration, and deny all other traffic.
   • CAllow all inbound traffic to the DMZ and rely on the web application firewall to filter malicious requests.
   • DAllow inbound traffic from the internet to the DMZ and outbound traffic from the DMZ to the internal network for database access.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common method used to implement network segmentation?

   • APlacing all servers in the same subnet as user workstations to reduce complexity
   • BUsing a single router without any filtering rules to connect all network devices
   • CDeploying VLANs and subnets with access control lists (ACLs) to control traffic between segments
   • DUsing a single flat VLAN for all devices to simplify management
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security operations center (SOC) is overwhelmed by alerts from multiple monitoring tools. The team wants to reduce alert fatigue while ensuring that critical incidents are not missed. They are considering implementing a SIEM to correlate logs and generate alerts. Which approach best addresses the trade-off between alert volume and detection coverage?

   • ADisable all alerts from the IDS and rely solely on firewall logs.
   • BIncrease the threshold for all alerts so that only high-severity events trigger alerts.
   • CDeploy a SIEM that ingests logs from firewalls, IDS/IPS, and servers, and create correlation rules that only alert on combinations of events that indicate a likely incident.
   • DImplement a ticketing system that automatically closes alerts after 24 hours without review.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team is investigating a suspected data exfiltration incident. They need to determine which internal host communicated with an external IP address at a specific time. Which data source is most useful for this investigation?

   • AFirewall logs that record source and destination IP addresses, ports, and timestamps.
   • BIntrusion detection system (IDS) alerts that show only the signatures triggered.
   • CVPN logs that show when remote users connected and disconnected.
   • DNetwork access control (NAC) logs that show when devices authenticated to the network.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is designing a defense-in-depth strategy for its network. They have a perimeter firewall, an internal firewall, and an IPS. They want to add another layer of defense to protect against threats that originate from inside the network. Which control should they add?

   • AIncrease logging on all network devices to improve visibility.
   • BImplement network segmentation to isolate sensitive systems and restrict lateral movement.
   • CAdd a second IPS at the internal network boundary.
   • DDeploy a network access control (NAC) solution to block non-compliant devices.
   Reveal Solution Discussion Select an answer first