Network Defenses GDSA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What are the two primary security functions provided by a VPN for remote access?

   • ATraffic filtering and malware scanning
   • BEncryption of traffic and authentication of users
   • CNetwork segmentation and access control lists
   • DData loss prevention and content filtering
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst notices repeated port scans from an internal IP address against multiple servers. The analyst wants to detect and automatically block the scanning host while still allowing legitimate traffic. Which control should be deployed?

   • AIncrease logging verbosity on the servers to capture more details about the scans.
   • BEnable an IPS rule that drops traffic from the scanning IP after a threshold of connection attempts is exceeded.
   • CDeploy an IDS sensor on the network segment and review alerts after the scan completes.
   • DConfigure a firewall rule to deny all traffic from the scanning IP, but only after manual confirmation from the analyst.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary role of a firewall in a network?

   • ATo authenticate users before they can access any network resource
   • BTo encrypt all traffic passing through the network
   • CTo detect and alert on malicious traffic patterns without blocking them
   • DTo filter traffic based on a set of rules to allow or block communications
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is investigating a potential data exfiltration incident. The analyst suspects that a server is sending large amounts of data to an external IP address on port 443. Which data source would provide the most direct evidence of the data transfer?

   • ASystem logs from the server showing user logins and application events.
   • BNetFlow records from the firewall showing the server's IP communicating with the external IP on port 443 and the volume of data transferred.
   • CDNS logs showing queries made by the server.
   • DAntivirus logs from the server showing malware detections.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security analyst is investigating a potential breach. The firewall logs show that an internal host made a connection to an external IP address on port 443, but the IDS did not generate an alert. The analyst suspects data exfiltration. Which additional data source would be most helpful to confirm the exfiltration?

   • AFirewall logs from the external IP address's network.
   • BIDS signature updates to see if the traffic matched a known exfiltration pattern.
   • CFull packet capture of the network traffic from the internal host to the external IP.
   • DNetwork access control (NAC) logs showing when the host authenticated.
   Reveal Solution Discussion Select an answer first