Managing Network Security GSLC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is designing a network for a new office. The security team wants to segment the network to protect sensitive systems, but the operations team needs to allow certain legacy devices to communicate across segments. Which approach best balances security and operational needs?

   • ACreate separate VLANs for sensitive systems and general users, and use a firewall to allow only necessary traffic between them.
   • BUse a router with access control lists that block all traffic between segments.
   • CImplement a software-defined network that automatically segments all traffic based on application identity.
   • DPlace all devices on a single flat network to simplify management and avoid compatibility issues.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial institution is subject to PCI DSS and must protect cardholder data. The network team is planning to segment the cardholder data environment (CDE) from the rest of the network. Which requirement is most directly addressed by this segmentation?

   • AAllowing the security team to monitor all network traffic more easily.
   • BEnsuring that all network traffic is encrypted in transit.
   • CLimiting the scope of the CDE and reducing the number of systems that must comply with PCI DSS controls.
   • DProviding a backup network in case the primary network fails.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security operations center (SOC) is overwhelmed by a high volume of alerts from its network monitoring tools. Many alerts are false positives, and the team is missing critical alerts. The SOC manager wants to improve the efficiency and effectiveness of monitoring. Which approach is most likely to achieve this?

   • ADisable all alerts that are not related to critical assets.
   • BTune the monitoring tools to reduce false positives and prioritize alerts based on risk and asset criticality.
   • CHire more analysts to review all alerts manually.
   • DIncrease the number of alerts by adding more monitoring tools to capture more data.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst detects unusual outbound traffic from a server in the DMZ to an unknown IP address on port 443. The traffic pattern is consistent with a command-and-control beacon. The incident response plan requires preserving evidence while minimizing further compromise. Which action should the analyst take first?

   • ABlock the outbound IP address on the firewall and continue monitoring.
   • BDisconnect the server from the network immediately to stop the beacon.
   • CCapture a memory dump and network traffic logs before taking any containment action.
   • DRebuild the server from a known-good image to eradicate the threat.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is investigating a potential network breach. The analyst notices that a user's workstation is sending data to an external server that is not on any approved list. The workstation also has a scheduled task that runs a script every hour. Which type of threat is most likely indicated?

   • AA backdoor or remote access Trojan that is exfiltrating data and maintaining persistence.
   • BA phishing email that tricked the user into clicking a link.
   • CA misconfigured application that is sending error reports to a vendor.
   • DA network switch that is flooding the network with broadcast traffic.
   Reveal Solution Discussion Select an answer first