Communication and Network Security GISP Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is software-defined networking (SDN)?

   • AA protocol for encrypting virtual network traffic
   • BA method for backing up network configurations
   • CAn approach that separates the control plane from the data plane to enable centralized network management
   • DA type of firewall that uses software to filter traffic
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is implementing secure instant messaging for internal communication. The security team requires that messages be encrypted end-to-end and that participants be authenticated. They also need to ensure that messages cannot be read by the server provider. Which technology should they choose?

   • AA web-based chat application over HTTPS with password authentication
   • BAn end-to-end encrypted messaging protocol with forward secrecy and out-of-band key verification
   • CEmail with S/MIME encryption
   • DTLS-encrypted messaging where the server holds the private keys
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security team is configuring an IPS to protect a web application. The IPS is currently in inline mode and has blocked several legitimate users because of false positives. The team needs to reduce false positives without losing the ability to block real attacks. Which configuration change should they make?

   • ASet the IPS to block all traffic that matches any signature
   • BSwitch the IPS to alert-only mode for a period, analyze the alerts, and then create custom rules that whitelist legitimate traffic patterns
   • CIncrease the sensitivity of all IPS signatures
   • DDisable the IPS entirely and rely on the firewall
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team is investigating a series of network anomalies. They notice that the internal DNS server is receiving a high volume of queries for a domain that the organization does not use. The queries are coming from many internal hosts. The team suspects the hosts are part of a botnet and are being used in a DNS amplification attack. However, the team also needs to maintain business operations that rely on DNS. Which action should they take first?

   • AConfigure the DNS server to rate-limit responses to the suspicious domain and enable response rate limiting (RRL)
   • BBlock all DNS queries from internal hosts at the firewall
   • CIgnore the traffic because DNS is a low-risk protocol
   • DTake the DNS server offline immediately
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary purpose of logging network and system events?

   • ATo automatically block malicious traffic
   • BTo replace the need for backups
   • CTo increase network performance
   • DTo provide a record for forensic analysis and incident investigation
   Reveal Solution Discussion Select an answer first