Network Monitoring for Managers GSLC Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A manager reviews a weekly report showing that a web server's inbound traffic spikes every night at 2:00 AM for 15 minutes, then returns to normal. The traffic is from a single external IP. The IDS has not alerted. What is the most likely explanation?

   • AA scheduled backup or maintenance job from a trusted partner
   • BA denial-of-service attack
   • CA brute-force attack on the web server
   • DA misconfigured monitoring system
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A manager is choosing between two monitoring tools: Tool A provides deep packet inspection (DPI) and can reconstruct sessions, but generates a high volume of alerts and requires significant storage. Tool B provides flow-based analysis (NetFlow) with lower storage requirements and fewer alerts, but cannot inspect packet contents. The organization's priority is detecting advanced persistent threats (APTs) that use encrypted channels. Which tool should the manager choose?

   • ATool B, because it requires less storage, which is more cost-effective
   • BTool B, because flow analysis is sufficient to detect APTs
   • CTool A, because DPI can inspect encrypted traffic if decryption is configured
   • DTool A, because it generates more alerts, which is better for security
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security manager reviews the weekly network monitoring report and notices that outbound bandwidth utilization has steadily increased by 15% each week for the past month, while inbound traffic remains flat. The increase is concentrated on a single server that normally generates little traffic. The manager also sees a spike in failed authentication attempts on that server. What is the most appropriate immediate action?

   • AInitiate the incident response process and investigate the server for signs of compromise
   • BIncrease the bandwidth allocation for the server to accommodate the new traffic pattern
   • CUpdate the network monitoring baseline to reflect the new normal
   • DDisable the server's network interface to stop the traffic
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A manager must choose between deploying NetFlow and a packet analyzer to monitor a critical application. The application is experiencing intermittent slowdowns, and the security team also wants to detect data exfiltration. The budget allows for only one new tool. Which choice best addresses both needs?

   • ADeploy NetFlow, because it provides flow-level visibility for both performance troubleshooting and anomaly detection
   • BDeploy both by reducing other security investments
   • CDeploy a packet analyzer, because it provides full packet contents for deep inspection
   • DUse only SNMP counters, because they are already available
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manager is reviewing the incident response process after a security incident. The monitoring system generated an alert, but the alert was not acted upon for several hours because the on-call person was not familiar with the alert's meaning. What should the manager implement to prevent this from happening again?

   • ADisable alerts that are not well understood
   • BReduce the number of alerts generated by the monitoring system
   • CRequire on-call staff to escalate all alerts immediately
   • DProvide training to on-call staff on alert interpretation and escalation procedures
   Reveal Solution Discussion Select an answer first