3.2 Use Command Center, Activity Insights, and Policy Optimizer to Improve Security Posture NETWORK-SECURITY-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When applying Policy Optimizer recommendations, what should an administrator do before making changes?

   • AReview the recommendation and understand the impact on traffic
   • BDisable the firewall to test the changes
   • CApply all recommendations immediately without review
   • DIgnore the recommendations and manually rewrite all policies
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An administrator notices that the 'Threats Prevented' widget on the Command Center dashboard shows a high number of 'ransomware' signatures. What is the MOST appropriate immediate action based on this observation?

   • AReboot the firewall to clear the threat logs.
   • BDisable the firewall's threat prevention profile to avoid false positives.
   • CDrill down into the threat logs to identify the affected systems and users.
   • DIgnore the spike because the threats were prevented.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What type of data does Activity Insights primarily analyze to provide visibility into network activity?

   • ANetwork topology maps
   • BFirewall configuration changes
   • CUser and application activity logs
   • DHardware inventory data
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company wants to enforce a policy that restricts the use of peer-to-peer file sharing. To understand the current usage before creating a new security rule, which Activity Insights data would provide the most relevant baseline?

   • AThe total number of threats prevented on the firewall
   • BA list of all security rules that currently allow peer-to-peer traffic
   • CA list of the top users and the volume of traffic for peer-to-peer applications
   • DThe number of firewall rule hits in the last 30 days
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is using Policy Optimizer to reduce the rulebase. They find a rule that is 'unused' but it is the ONLY rule that allows a specific legacy application. The application is no longer used by the business, but the rule has been in place for years. What is the BEST action?

   • ADisable the rule and monitor for any impact for 30 days.
   • BKeep the rule because it has been in place for years and might be needed in the future.
   • CModify the rule to allow 'any' application to ensure it is not missed.
   • DRemove the rule after confirming with the application owner that the application is decommissioned.
   Reveal Solution Discussion Select an answer first