CySA+ Test Network Monitoring 5

Question 1

A SOC analyst receives a SIEM alert for 'impossible travel' — a user authenticated from New York and then from Tokyo 30 minutes later.
Which additional data source should the analyst check FIRST to determine if the account is compromised?

Accepted Answer

VPN and proxy connection logs to check for geographic IP spoofing

Answer

Antivirus scan results on the endpoint

Answer

Physical access badge logs

Answer

Email server delivery logs

Question 2

Which sFlow sampling rate provides the BEST balance between network overhead and detection fidelity for a 10 Gbps link?

Accepted Answer

1:1000 (one in 1000 packets)

Answer

1:1 (all packets)

Answer

1:100 (one in 100 packets)

Answer

1:10000 (one in 10,000 packets)

Question 3

An analyst investigates an alert where an internal host sent a 2 MB HTTP POST to an external IP at 3:00 AM. The destination IP has no DNS record and low reputation. What is the MOST appropriate immediate action?

Accepted Answer

Isolate the host and preserve disk and memory forensics

Answer

Reimage the workstation without further investigation

Answer

Block the destination IP in the firewall only

Answer

Increase logging verbosity on the web proxy

Question 4

A threat hunter notices recurring outbound SMB (port 445) connections from a workstation to an internet IP. Why is this significant from a CySA+ perspective?

Accepted Answer

SMB should never traverse the internet; this suggests a firewall misconfiguration or active attack

Answer

SMB over the internet is common for cloud file sharing

Answer

SMB is only used for printer sharing and is low risk

Answer

This indicates Windows Update traffic being misclassified

Question 5

Which metric from a network monitoring dashboard BEST indicates an ongoing SYN flood attack against a public web server?

Accepted Answer

High ratio of HALF-OPEN (SYN_RECEIVED) to ESTABLISHED connections

Answer

High number of ESTABLISHED TCP connections

Answer

Increased HTTP 404 error rates

Answer

Elevated DNS query response times

Question 6

An analyst configures a network TAP versus a SPAN port for packet capture. What is the PRIMARY advantage of a TAP over a SPAN port?

Accepted Answer

TAPs capture all traffic including errors without impacting switch performance or dropping packets

Answer

TAPs are less expensive than SPAN ports

Answer

SPAN ports require additional licensing fees

Answer

TAPs support higher encryption standards

Question 7

During incident response, a SOC analyst uses Zeek (formerly Bro) logs. Which Zeek log file is MOST useful for identifying exfiltration via HTTP?

Accepted Answer

http.log

Answer

conn.log

Answer

ssl.log

Answer

dns.log