Defensive Technologies and Emerging Intelligence GISF Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a typical role of an intrusion prevention system (IPS) in a network?

   • AIt blocks malicious traffic in real time before it reaches its destination
   • BIt encrypts data transmitted between two hosts
   • CIt provides a log of all user authentication attempts
   • DIt scans endpoints for malware and removes infections
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company discovered that a critical vulnerability exists in a third-party library used by its web application. The vendor has released a patch, but the patch requires a reboot of the server, which would cause downtime during business hours. The vulnerability is actively being exploited in the wild. What is the most appropriate immediate action?

   • AApply the patch immediately, even if it causes downtime, because the vulnerability is actively exploited.
   • BImplement a workaround, such as a web application firewall rule, and defer the patch indefinitely.
   • CWait until the next maintenance window to apply the patch to avoid downtime.
   • DUninstall the third-party library to eliminate the vulnerability.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's endpoints are infected with ransomware that encrypts files and demands payment. The company has backups, but the backups are also encrypted because they were stored on the same network share. Which control would have most effectively prevented this scenario?

   • ADeploy antivirus software on all endpoints.
   • BUse a firewall to block outbound traffic to known ransomware command-and-control servers.
   • CImplement a patch management program to keep operating systems up to date.
   • DStore backups offline or in an isolated, immutable storage location.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations center (SOC) receives alerts from multiple sources: firewall logs, IDS alerts, and endpoint detection logs. The analysts are overwhelmed by the volume of alerts and are missing critical incidents. Which control would most directly help the analysts prioritize and correlate these alerts?

   • ADisable the endpoint detection logs to reduce noise.
   • BDeploy a SIEM to aggregate and correlate the logs, with rules to generate prioritized alerts.
   • CIncrease the sensitivity of the IDS to catch more alerts.
   • DHire more analysts to manually review all alerts.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is threat intelligence?

   • AInformation about potential or current threats that helps organizations make informed security decisions
   • BA type of firewall that blocks malicious IP addresses
   • CA vulnerability scanner that identifies zero-day exploits
   • DA process for encrypting data to prevent data breaches
   Reveal Solution Discussion Select an answer first