Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which of the following best describes the primary purpose of defensive technologies in an information system?

   • ATo monitor user activity and enforce organizational policies
   • BTo provide a secure backup and recovery mechanism for all critical data
   • CTo detect, prevent, and mitigate threats that could compromise the confidentiality, integrity, or availability of information
   • DTo ensure that all data is encrypted at rest and in transit
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

   • AAn IDS monitors network traffic, while an IPS monitors host activity
   • BAn IDS uses signatures, while an IPS uses behavioral analysis
   • CAn IDS only detects and alerts on suspicious activity, while an IPS can also block or prevent the activity
   • DAn IDS is deployed at the network perimeter, while an IPS is deployed on endpoints
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following is a common use of encryption to protect data in transit?

   • AUsing a VPN to encrypt all traffic between a remote user and the corporate network
   • BEncrypting a hard drive with BitLocker
   • CHashing passwords before storing them in a database
   • DUsing TLS to secure communication between a web browser and a web server
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A network administrator is designing a new network for a small office. The office has a public web server, internal workstations, and a database server. The administrator wants to ensure that the web server is accessible from the internet, but the database server is not directly accessible from the internet. Which defensive technology is most appropriate to achieve this?

   • APlace the web server in a DMZ and the database server on the internal network, with a firewall controlling traffic between them.
   • BPlace both servers on the same network segment and rely on host-based firewalls.
   • CUse a VPN for all internet access to the web server.
   • DUse a network-based intrusion detection system (IDS) to monitor traffic to the database server.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A SOC uses a SIEM to collect logs from firewalls, IDS, and endpoints. The SIEM generates a high number of alerts, most of which are false positives. Analysts are missing real incidents because they are overwhelmed. Which strategy would most effectively improve the signal-to-noise ratio?

   • ASet the SIEM to alert on every single log entry.
   • BIncrease the number of alerts by adding more log sources.
   • CDisable all SIEM alerts and rely on manual log review.
   • DTune the SIEM correlation rules to reduce false positives and prioritize alerts based on asset criticality.
   Reveal Solution Discussion Select an answer first