CySA+ Test Network Monitoring 5

Question 1

A SOC analyst receives a SIEM alert for 'impossible travel' — a user authenticated from New York and then from Tokyo 30 minutes later. Which additional data source should the analyst check FIRST to determine if the account is compromised?

Accepted Answer

VPN and proxy connection logs to check for geographic IP spoofing

Answer

Before assuming compromise, checking VPN and proxy logs can reveal whether the Tokyo IP is an exit node that explains the geographic anomaly.

Question 2

Which sFlow sampling rate provides the BEST balance between network overhead and detection fidelity for a 10 Gbps link?

Accepted Answer

1:1000 (one in 1000 packets)

Answer

A 1:1000 sampling rate on a 10 Gbps link provides statistically meaningful traffic visibility while keeping collection overhead manageable.

Question 3

An analyst investigates an alert where an internal host sent a 2 MB HTTP POST to an external IP at 3:00 AM. The destination IP has no DNS record and low reputation. What is the MOST appropriate immediate action?

Accepted Answer

Isolate the host and preserve disk and memory forensics

Answer

Isolating the host stops further damage while preserving volatile and disk evidence needed to determine the scope and root cause of the potential compromise.

Question 4

A threat hunter notices recurring outbound SMB (port 445) connections from a workstation to an internet IP. Why is this significant from a CySA+ perspective?

Accepted Answer

SMB should never traverse the internet; this suggests a firewall misconfiguration or active attack

Answer

SMB is an internal protocol that should never appear as outbound internet traffic; its presence indicates either a firewall gap, malware lateral movement preparation, or active exploitation.

Question 5

Which metric from a network monitoring dashboard BEST indicates an ongoing SYN flood attack against a public web server?

Accepted Answer

High ratio of HALF-OPEN (SYN_RECEIVED) to ESTABLISHED connections

Answer

A SYN flood consumes server resources by leaving connections in SYN_RECEIVED state without completing the handshake, dramatically increasing the half-open to established ratio.

CySA+ Practice Test Practice Test

CySA+ Practice Test Practice Test

CySA+ Test Network Monitoring 5