3.2 Use Command Center, Activity Insights, and Policy Optimizer to Improve Security Posture NETWORK-SECURITY-ANALYST Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A firewall administrator is reviewing Policy Optimizer recommendations and sees a rule flagged as 'overly permissive' because it allows 'any' service. What is the recommended action for this type of rule?

   • AIncrease the rule's logging level to capture more details.
   • BReplace 'any' with the specific services and applications that are actually used.
   • CChange the rule's action from 'allow' to 'deny'.
   • DMove the rule to the top of the rulebase to ensure it is evaluated first.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   When investigating a user's activity in Activity Insights, which of the following would be most indicative of a potential threat?

   • AThe user logging in from a new location at an unusual time
   • BThe user sending a large email attachment to a colleague
   • CThe user accessing a file-sharing site during lunch break
   • DThe user accessing a frequently used internal application
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   A security auditor has flagged that several firewall rules are 'shadow' rules. What does this status indicate about these rules, and what is the recommended action?

   • AThe rules are redundant because a preceding rule already covers the same traffic; they should be removed.
   • BThe rules are misconfigured and causing a security gap; they should be edited immediately.
   • CThe rules are new and have not yet been fully deployed; they should be enabled.
   • DThe rules are actively blocking malicious traffic; they should be kept and monitored.
   Reveal Solution Discussion Select an answer first