3.2 Use Command Center, Activity Insights, and Policy Optimizer to Improve Security Posture NETWORK-SECURITY-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an incident investigation, an analyst needs to identify all users who have accessed a specific high-risk application in the last 24 hours. Which Activity Insights view or filter would be the MOST direct way to produce this list?

   • AFilter the Application Usage view by the specific application and time range, then review the associated users.
   • BReview the Threat Activity view for the last 24 hours and note the source IPs.
   • CExamine the Command Center's 'Top Users' widget without applying any filters.
   • DCheck the Policy Optimizer report for rules that allow the application.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's firewall policy has grown to over 1,000 rules over several years. The security team wants to reduce the attack surface by removing rules that are no longer needed. Using Policy Optimizer, which type of rule should the team prioritize for review and cleanup?

   • ARules with a 'disabled' status that are part of a security policy group
   • BRules with a 'shadow' status that have never matched traffic
   • CRules with a 'cleanup' status that have matched traffic in the last 90 days
   • DRules with a 'used' status that are associated with a specific application
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst sees a steady increase in 'Blocked' traffic on the Command Center dashboard over the past month. The increase correlates with a new marketing campaign. The analyst suspects the increase is due to legitimate marketing emails being blocked. What is the MOST effective way to confirm this hypothesis using the available tools?

   • ACheck the Policy Optimizer report for rules that are blocking 'any' application.
   • BReview the Activity Insights 'User Activity' view to see if the increase is from a specific user group.
   • CDisable the firewall's threat prevention profile to see if the blocked traffic stops.
   • DCorrelate the 'Blocked' traffic in the Command Center with the specific URL categories and threat signatures in the logs.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a type of policy issue that Policy Optimizer is designed to detect?

   • APolicies that are overly permissive
   • BPolicies that are not aligned with business goals
   • CPolicies that are written in a different language
   • DPolicies that are too restrictive
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A firewall has a rule that allows 'any' application to a group of servers. Policy Optimizer recommends replacing 'any' with a specific list of applications. The administrator is concerned about breaking a legacy application that is rarely used but critical. What is the BEST approach to safely apply this recommendation?

   • ACreate a new rule above the current one to allow the legacy app, then apply the recommendation.
   • BReject the recommendation because Policy Optimizer is not reliable for legacy applications.
   • CReview the application usage data in Activity Insights to confirm the legacy app is included in the recommended list before applying.
   • DApply the recommendation immediately and monitor the logs for a week.
   Reveal Solution Discussion Select an answer first