4.2 - Understand Network Threats and Attacks CC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What does a Network-based Intrusion Detection System (NIDS) primarily analyze?

   • ANetwork traffic to detect threats across the network.
   • BThe configuration of firewalls and routers.
   • CSystem logs on individual hosts.
   • DFile integrity on servers.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does a firewall prevent unauthorized access?

   • ABy detecting and alerting on suspicious activity.
   • BBy scanning files for malware signatures.
   • CBy encrypting all network traffic.
   • DBy filtering traffic based on a set of security rules.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network administrator is deploying a security tool that will analyze traffic at the network perimeter to detect known attack signatures and anomalous patterns. The tool must be able to see all traffic entering and leaving the organization's network. Which deployment approach is most appropriate?

   • AInstall a host-based intrusion detection system (HIDS) on every server
   • BConfigure the firewall to log all traffic and review the logs manually
   • CPlace a network-based intrusion detection system (NIDS) on a SPAN port or network tap at the perimeter
   • DDeploy an intrusion prevention system (IPS) in inline mode
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a key advantage of a Network-based IDS (NIDS) over a Host-based IDS (HIDS)?

   • AIt can detect attacks that are encrypted within the host's filesystem.
   • BIt can monitor the internal activity of each individual host.
   • CIt can monitor traffic across the entire network from a single vantage point.
   • DIt can block malicious traffic in real time.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is conducting a vulnerability scan of its internal network. The scan reports that a web server is running an outdated version of Apache with a known remote code execution vulnerability. The team needs to prioritize remediation. What is the most important factor to consider when prioritizing this finding?

   • AThe number of other servers running the same version of Apache
   • BThe severity of the vulnerability and the exposure of the web server to the internet
   • CThe cost of the vulnerability scanner
   • DThe age of the web server hardware
   Reveal Solution Discussion Select an answer first