CCD Network Defense & Monitoring 3

Question 1

Which security control is BEST suited to detect an insider threat exfiltrating data via authorized cloud storage applications?

Accepted Answer

Data Loss Prevention (DLP) solution

Answer

DLP solutions inspect content and context of data transfers, detecting policy violations even through authorized channels like cloud storage.

Question 2

In a zero-trust network architecture, what is the primary principle governing access decisions?

Accepted Answer

Access is granted based on verified identity and device posture, regardless of network location

Answer

Zero-trust eliminates implicit trust based on network location, requiring continuous verification of identity, device health, and least-privilege access.

Question 3

A Snort IDS rule contains the option `flags:S;`. What traffic does this match?

Accepted Answer

TCP packets with only the SYN flag set

Answer

The `flags:S;` option in Snort matches TCP segments with only the SYN flag set, commonly used to detect SYN scan activity.

Question 4

Which log source would BEST help identify a compromised web server being used to serve malware to visitors?

Accepted Answer

Web server access and error logs

Answer

Web server access and error logs reveal unusual file requests, injected redirects, and suspicious response codes indicating drive-by malware distribution.

Question 5

What does the term 'east-west traffic' refer to in network security monitoring?

Accepted Answer

Traffic flowing between servers and workstations within the same data center or network segment

Answer

East-west traffic describes lateral communication between hosts inside a network, which is critical to monitor for detecting attacker lateral movement.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Network Defense & Monitoring 3