Cyber Defense Principles GMON Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security engineer is configuring a new server that will host a public-facing application. The engineer wants to ensure that if the application is compromised, the attacker cannot easily access other systems on the network. Which configuration best supports this goal?

   • APlace the server in a DMZ and restrict outbound traffic to only necessary ports.
   • BConnect the server directly to the internal network to simplify access.
   • CUse the same credentials for the server and the internal network.
   • DDisable the server's firewall to allow all traffic.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A small company hosts a web application on a single server that also contains the database. The server is directly exposed to the internet on ports 80 and 443. The security team wants to implement defense-in-depth without adding significant hardware cost. Which combination of controls provides the most layered protection?

   • AEnable TLS on the web server and require strong passwords for all user accounts.
   • BInstall a host-based firewall, apply the latest security patches, and enable application-level authentication.
   • CUse a cloud-based web application firewall and disable the server's built-in firewall.
   • DMove the database to a separate physical server and block all inbound traffic except from the web server.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company's risk management team is evaluating the risk of a ransomware attack. They determine that the cost of implementing a robust backup and recovery solution is lower than the potential financial loss from an attack. According to risk management principles, what should the company do?

   • ATransfer the risk by purchasing cyber insurance instead of implementing backups.
   • BImplement the backup and recovery solution to mitigate the risk.
   • CAccept the risk because the likelihood of an attack is low.
   • DAvoid the risk by disconnecting the company from the internet.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security team is implementing a new monitoring system. The team has a limited budget and must choose between two controls: a network-based intrusion detection system (IDS) that covers the entire network, or a host-based security agent that provides deep visibility into each server. The organization's primary concern is a targeted attack that could compromise a single critical server. Which control should the team prioritize?

   • ANeither control, because the organization should focus on prevention rather than detection.
   • BThe host-based agent, because it provides direct visibility into the critical server's activity.
   • CBoth controls, because defense-in-depth requires multiple layers.
   • DThe network IDS, because it can detect attacks across the entire network.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is designing a monitoring solution for a multi-site organization. The team wants to ensure that a compromise at one site does not go unnoticed by the central security operations center (SOC). Which approach best supports this goal?

   • ARely on the organization's internet service provider to monitor for suspicious activity.
   • BDeploy sensors at each site and forward logs to a central SIEM for correlation and analysis.
   • CUse a single sensor at the central site to monitor all traffic via VPN.
   • DKeep logs at each site and have local administrators review them weekly.
   Reveal Solution Discussion Select an answer first