CySA+ Test Network Monitoring 4

Question 1

A security analyst reviews firewall logs and notices repeated outbound connections to port 443 on IP addresses with poor reputation scores lasting only 2-3 seconds each.
What should the analyst investigate FIRST?

Accepted Answer

Short-lived encrypted sessions consistent with C2 check-ins

Answer

Firewall rule misconfiguration allowing the traffic

Answer

CDN traffic to edge nodes

Answer

Antivirus cloud lookup activity

Question 2

Which log source is MOST valuable for detecting unauthorized VLAN traversal (VLAN hopping) attacks?

Accepted Answer

Managed switch port security and trunk configuration logs

Answer

Windows Security event logs

Answer

DNS server query logs

Answer

Web proxy access logs

Question 3

An IDS generates 1,200 alerts per day, of which investigation reveals 95% are false positives. Which action BEST reduces alert fatigue while maintaining detection capability?

Accepted Answer

Tune signatures with contextual filters and whitelist known-good traffic

Answer

Disable the IDS signatures generating the most alerts

Answer

Increase IDS sensitivity to catch more events

Answer

Switch exclusively to a blacklist-based detection model

Question 4

During threat hunting, an analyst queries logs for PowerShell processes spawned by Microsoft Word. Which log source provides the MOST direct evidence of this parent-child process relationship?

Accepted Answer

Windows Security Event Log (Event ID 4688) with process tracking enabled

Answer

Network flow data

Answer

DNS query logs

Answer

Firewall deny logs

Question 5

A packet capture shows a host receiving large DNS responses (>512 bytes) via UDP for queries it never sent. What attack does this MOST likely represent?

Accepted Answer

DNS amplification attack (DDoS)

Answer

DNS cache poisoning

Answer

DNS zone transfer

Answer

DNSSEC key rollover

Question 6

Which network monitoring technique can detect slow port scans designed to evade rate-based IDS thresholds?

Accepted Answer

Long-window statistical analysis correlating connection attempts over hours

Answer

Real-time signature matching

Answer

Deep packet inspection of payloads

Answer

Bandwidth utilization graphing

Question 7

An analyst correlates web proxy logs and sees a single workstation accessing 300 unique domains over 10 minutes, most resolving to the same /24 subnet. What does this MOST suggest?

Accepted Answer

Fast-flux DNS infrastructure used by malware

Answer

Normal browser pre-fetching behavior

Answer

CDN load balancing across nodes

Answer

BGP route flapping