CySA+ Test Network Monitoring 4

Question 1

A security analyst reviews firewall logs and notices repeated outbound connections to port 443 on IP addresses with poor reputation scores lasting only 2-3 seconds each. What should the analyst investigate FIRST?

Accepted Answer

Short-lived encrypted sessions consistent with C2 check-ins

Answer

Brief, recurring HTTPS connections to low-reputation IPs are a classic indicator of malware performing encrypted C2 check-ins.

Question 2

Which log source is MOST valuable for detecting unauthorized VLAN traversal (VLAN hopping) attacks?

Accepted Answer

Managed switch port security and trunk configuration logs

Answer

VLAN hopping exploits trunk port configurations; managed switch logs revealing unauthorized double-tagged frames or trunk negotiation are the primary detection source.

Question 3

An IDS generates 1,200 alerts per day, of which investigation reveals 95% are false positives. Which action BEST reduces alert fatigue while maintaining detection capability?

Accepted Answer

Tune signatures with contextual filters and whitelist known-good traffic

Answer

Tuning IDS signatures with contextual filters and trusted-source whitelists reduces false positives without disabling detection for genuine threats.

Question 4

During threat hunting, an analyst queries logs for PowerShell processes spawned by Microsoft Word. Which log source provides the MOST direct evidence of this parent-child process relationship?

Accepted Answer

Windows Security Event Log (Event ID 4688) with process tracking enabled

Answer

Windows Security Event ID 4688 with process creation auditing records parent and child process details, directly showing Word spawning PowerShell.

Question 5

A packet capture shows a host receiving large DNS responses (>512 bytes) via UDP for queries it never sent. What attack does this MOST likely represent?

Accepted Answer

DNS amplification attack (DDoS)

Answer

Receiving unsolicited large DNS UDP responses indicates the host's IP is being used as a spoofed target in a DNS amplification DDoS attack.

CySA+ Practice Test Practice Test

CySA+ Practice Test Practice Test

CySA+ Test Network Monitoring 4