CCD Network Defense & Monitoring 3 — Questions and Answers
Question 1: Which security control is BEST suited to detect an insider threat exfiltrating data via authorized cloud storage applications?
- Network firewall
- Data Loss Prevention (DLP) solution (Correct answer)
- Intrusion Prevention System (IPS)
- Web Application Firewall (WAF)
Correct answer: Data Loss Prevention (DLP) solution
DLP solutions inspect content and context of data transfers, detecting policy violations even through authorized channels like cloud storage.
Question 2: In a zero-trust network architecture, what is the primary principle governing access decisions?
- Users inside the perimeter are trusted by default
- Access is granted based on verified identity and device posture, regardless of network location (Correct answer)
- VPN connections grant full internal network access
- IP address determines trust level
Correct answer: Access is granted based on verified identity and device posture, regardless of network location
Zero-trust eliminates implicit trust based on network location, requiring continuous verification of identity, device health, and least-privilege access.
Question 3: A Snort IDS rule contains the option `flags:S;`. What traffic does this match?
- TCP packets with only the SYN flag set (Correct answer)
- TCP packets with SYN and ACK flags set
- UDP packets
- All TCP packets regardless of flags
Correct answer: TCP packets with only the SYN flag set
The `flags:S;` option in Snort matches TCP segments with only the SYN flag set, commonly used to detect SYN scan activity.
Question 4: Which log source would BEST help identify a compromised web server being used to serve malware to visitors?
- Windows Security Event Log
- Web server access and error logs (Correct answer)
- DHCP server logs
- DNS server query logs
Correct answer: Web server access and error logs
Web server access and error logs reveal unusual file requests, injected redirects, and suspicious response codes indicating drive-by malware distribution.
Question 5: What does the term 'east-west traffic' refer to in network security monitoring?
- Internet-bound traffic from internal hosts
- Traffic flowing between servers and workstations within the same data center or network segment (Correct answer)
- Traffic between geographically distributed data centers
- Encrypted VPN tunnel traffic
Correct answer: Traffic flowing between servers and workstations within the same data center or network segment
East-west traffic describes lateral communication between hosts inside a network, which is critical to monitor for detecting attacker lateral movement.
Question 6: A defender configures ACLs to block all traffic except TCP 443 to a sensitive server. An attacker then tunnels malicious traffic over HTTPS. Which control would BEST detect this?
- Tighten the ACL to block port 443 as well
- SSL/TLS inspection combined with application-layer IDS (Correct answer)
- Increase firewall log retention
- Deploy a honeypot on port 443
Correct answer: SSL/TLS inspection combined with application-layer IDS
SSL/TLS inspection decrypts HTTPS traffic so application-layer IDS signatures can inspect payload content for malicious activity.
Question 7: Which SIEM correlation rule would BEST detect a brute-force SSH attack?
- Alert on any SSH connection attempt
- Alert when more than 10 failed SSH authentications occur from one source within 60 seconds (Correct answer)
- Alert on successful SSH logins
- Alert when SSH traffic exceeds 1 MB
Correct answer: Alert when more than 10 failed SSH authentications occur from one source within 60 seconds
Thresholding multiple failed authentication attempts within a short time window is the standard method for detecting brute-force attacks.
CCD Network Defense & Monitoring 3
Which security control is BEST suited to detect an insider threat exfiltrating data via authorized cloud storage applications?