I85PREP
⌘ K
C|CT study materials
C|CT study resources

C|CT practice questions

One question at a time. Build your C|CT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Defense

Which device is specifically designed to filter traffic between network segments by evaluating packets against a configured rule set?

  1. A stateful firewall Correct answer.
  2. A media converter
  3. A Layer 2 switch
  4. A load balancer

Explanation

A firewall inspects packet headers and, in stateful implementations, connection state, then permits or denies traffic according to policy. Switches and load balancers forward traffic but are not policy enforcement points in the same sense.

Question 2Network Defense

An analyst needs to detect a host that is beaconing to command-and-control infrastructure every 60 seconds. Which detection approach most directly targets this behavior?

  1. Alerting on high CPU utilization on internal servers
  2. Alerting on repeated outbound connections with consistent intervals to the same destination Correct answer.
  3. Alerting on failed logon attempts within a domain
  4. Alerting on any inbound connection to port 443

Explanation

Beaconing is characterized by periodic, regular outbound connections to a fixed destination, so interval and destination consistency are the defining observables. The other alerts describe unrelated events that would not reliably identify command-and-control traffic.

Question 3Network Defense

Which statement best describes the role of an intrusion detection system deployed in promiscuous mode on a SPAN port?

  1. It assigns IP addresses to endpoints on the monitored segment
  2. It terminates TLS sessions and re-encrypts them toward the server
  3. It observes copies of traffic and generates alerts without blocking the flows Correct answer.
  4. It rewrites packet headers before forwarding them to the destination

Explanation

A passive IDS receives mirrored traffic, analyzes it, and raises alerts; because it is not inline, it cannot drop the packets it inspects. Inline blocking is the role of an intrusion prevention system.

Question 4Network Defense

A security team wants to block exploitation attempts in real time while still alerting on suspicious traffic. Which deployment satisfies both requirements?

  1. A syslog server receiving device logs
  2. A netflow collector aggregating flow records
  3. An inline intrusion prevention system with alerting enabled Correct answer.
  4. A passive intrusion detection system on a mirror port

Explanation

Only an inline prevention system sits in the traffic path and can drop malicious packets while still generating alerts. Passive sensors, flow collectors, and log servers observe activity but cannot block it.

Question 5Network Defense

Which control most directly limits lateral movement between virtual machines hosted on the same hypervisor?

  1. Microsegmentation policies enforced at the virtual switch Correct answer.
  2. Centralized syslog collection
  3. Disk encryption on the hypervisor host
  4. A perimeter firewall at the internet edge

Explanation

Traffic between guests on one hypervisor may never cross the physical perimeter, so enforcement must occur at the virtual switch through microsegmentation. Edge firewalls and logging do not restrict that east-west path.

Question 6Network Defense

In a demilitarized zone design, which placement is most appropriate for an internet-facing web server that must be reachable from untrusted networks?

  1. On the internal corporate VLAN alongside user workstations
  2. On the same subnet as the domain controllers
  3. On a segmented DMZ reachable from the internet and from the internal network only through a firewall Correct answer.
  4. On an isolated VLAN with no firewall between it and the internal network

Explanation

A DMZ separates externally reachable systems from the trusted internal network so that a compromise does not grant direct internal access. Placing the server among internal assets removes that containment.

Question 7Network Defense

An organization must retain full packet captures for investigations while reducing storage cost. Which approach best meets both goals?

  1. Store only flow records and discard all packet captures
  2. Disable capture on high-volume links and rely on host logs only
  3. Capture full packets for a short rolling window and store flow records for a longer period Correct answer.
  4. Capture full packets indefinitely on every link

Explanation

A tiered strategy keeps detailed evidence for the window when it is most useful while preserving lightweight metadata for long-term trending and scoping. Discarding captures entirely or retaining everything indefinitely are the two cost-blind extremes.

Question 8Network Defense

Which artifact from a proxy log most directly indicates that an internal host contacted a domain generated by a domain generation algorithm?

  1. Many requests to numerous algorithmically similar, previously unseen domains Correct answer.
  2. Repeated requests to an internal intranet site
  3. A large download from a recognized content delivery network
  4. A single request to a well-known software update domain

Explanation

Domain generation algorithms produce large volumes of pseudo-random domains that a host queries while seeking its live controller. High counts of never-before-seen, structurally similar domains are the characteristic signal.

Question 9Network Defense

What is the primary defensive purpose of enforcing egress filtering on a corporate network?

  1. Encrypting traffic between internal hosts
  2. Simplifying the assignment of IP addresses to endpoints
  3. Increasing inbound bandwidth for public web services
  4. Restricting outbound traffic to approved destinations to hinder data exfiltration and command-and-control Correct answer.

Explanation

Egress filtering limits which external destinations internal hosts may reach, which constrains exfiltration channels and outbound command-and-control. It does not provide bandwidth, addressing, or encryption functions.

Question 10Network Defense

A sensor reports a flood of SYN packets from many spoofed source addresses toward one server. Which mitigation is most appropriate at the network edge?

  1. Enable SYN cookies and rate limiting on the affected service path Correct answer.
  2. Move the server to the same VLAN as user devices
  3. Disable logging on the affected server
  4. Increase the TCP retransmission timeout globally

Explanation

SYN flood defenses rely on absorbing half-open connection state, which SYN cookies and rate limiting accomplish. The other choices either reduce visibility or worsen the exposure of the target.

Question 11Network Defense

Which characteristic distinguishes a stateful firewall from a stateless packet filter?

  1. It inspects application payloads for malware signatures
  2. It tracks connection state and can permit return traffic for sessions it observed being established Correct answer.
  3. It assigns VLAN tags to untagged frames
  4. It resolves domain names for internal clients

Explanation

Stateful inspection maintains a session table so that replies to permitted outbound flows are allowed without a separate inbound rule. Payload malware inspection and VLAN tagging belong to other technologies.

Question 12Network Defense

An administrator must allow remote administrators to manage devices without exposing management interfaces to the internet. Which design best achieves this?

  1. Publish management interfaces directly with strong passwords
  2. Expose management ports to the internet but change them to nonstandard numbers
  3. Allow management access from any internal subnet without restriction
  4. Require access through a hardened jump host reachable only over an encrypted VPN Correct answer.

Explanation

A bastion or jump host behind a VPN concentrates administrative access into a single audited choke point and keeps management planes off the public internet. Direct exposure, even with strong credentials or port obfuscation, remains an unnecessary attack surface.

Question 13Network Defense

Which log source is most useful for identifying which internal host resolved a suspicious domain name?

  1. DHCP lease renewal events
  2. DNS server query logs Correct answer.
  3. Firewall session table exports
  4. Switch MAC address tables

Explanation

DNS query logs record the requesting client and the queried name, which directly answers who resolved a domain. The other sources lack name resolution detail.

Question 14Network Defense

A network team wants to detect unauthorized devices plugged into access ports. Which combination provides the strongest control?

  1. Static ARP entries on user workstations
  2. Increasing the DHCP lease duration
  3. 802.1X port authentication combined with port security limiting learned MAC addresses Correct answer.
  4. Disabling spanning tree on all access ports

Explanation

802.1X authenticates the supplicant before granting network access, and port security caps which MAC addresses may appear on a port. Together they address both identity and rogue hardware.

Question 15Network Defense

During analysis of a suspected compromise, an analyst sees a workstation establish an outbound session to an unfamiliar external IP on port 4444 and maintain it for hours. Which interpretation is most reasonable?

  1. The session must be inbound scanning activity
  2. The pattern is consistent with an interactive remote-access channel and warrants investigation Correct answer.
  3. The traffic is certainly a legitimate software update and can be ignored
  4. The port number alone proves the traffic is benign

Explanation

A long-lived outbound session to an unknown external host on a commonly abused port fits remote shell or beacon behavior and should be investigated. Port numbers alone never prove intent, and the flow direction is outbound rather than scanning.

Question 16Network Defense

Which measure best reduces the value of captured credentials when an attacker gains access to network traffic?

  1. Enabling port mirroring on all switches
  2. Segmenting the network into VLANs
  3. Increasing the size of capture buffers
  4. Enforcing encrypted management protocols such as SSH and TLS Correct answer.

Explanation

Encryption prevents an eavesdropper from reading credentials even if traffic is captured. Segmentation limits reachability but does not protect data in transit on a shared path.

Question 17Network Defense

What is the primary function of network address translation in a perimeter defense context?

  1. Hiding internal addressing from external observers while enabling outbound connectivity Correct answer.
  2. Encrypting payloads between internal and external hosts
  3. Detecting malware signatures in packet payloads
  4. Authenticating users against a directory service

Explanation

NAT rewrites addresses so internal hosts are not directly addressable from outside, which incidentally obscures internal topology. It provides no encryption, authentication, or content inspection.

Question 18Network Defense

An analyst must determine whether a suspicious file was transferred over a cleartext protocol. Which evidence is most decisive?

  1. An interface counter showing increased throughput
  2. A packet capture containing the protocol headers and payload of the transfer Correct answer.
  3. A firewall log showing an allowed connection
  4. A DNS log showing a resolved name

Explanation

Only a capture with payload lets the analyst confirm content and protocol, because cleartext transfer is directly visible. Logs and counters confirm that traffic occurred but not what was carried.

Question 19Network Defense

A company wants to detect data exfiltration over DNS tunneling. Which indicator is most relevant?

  1. A sudden decrease in the number of DNS queries
  2. Unusually long or high-entropy subdomain labels in repeated queries to one domain Correct answer.
  3. Queries for the organization's own public website
  4. Use of DNSSEC validation on internal resolvers

Explanation

DNS tunneling encodes data in query names, producing long, high-entropy labels repeatedly sent to a single authoritative domain. DNSSEC and normal internal lookups do not exhibit that pattern.

Question 20Network Defense

Which practice best supports consistent triage of network security alerts across shifts?

  1. Documented escalation criteria and severity definitions applied to every alert Correct answer.
  2. Routing all alerts directly to the firewall administrator
  3. Disabling low-severity alerts to reduce queue volume
  4. Relying on individual analyst judgment without written guidance

Explanation

Written escalation criteria and severity definitions give every analyst the same decision rules, which produces repeatable triage. Undocumented judgment and alert suppression create inconsistency and blind spots.

Question 21Network Defense

A web application firewall is deployed in front of an internet-facing service. Which protection does it provide that a network firewall typically does not?

  1. Establishment of VPN tunnels for remote users
  2. Assignment of addresses to internal clients
  3. Inspection of HTTP request content against application-layer attack patterns Correct answer.
  4. Filtering of traffic by source IP address

Explanation

A WAF parses application-layer requests and matches them against rules for injection, cross-site scripting, and similar attacks. Address filtering and VPN termination are network-layer functions.

Question 22Network Defense

Which configuration on a switch most directly mitigates ARP spoofing between hosts on the same VLAN?

  1. Dynamic ARP inspection with DHCP snooping bindings Correct answer.
  2. Disabling storm control on access ports
  3. Increasing the ARP cache timeout
  4. Enabling jumbo frames on uplinks

Explanation

Dynamic ARP inspection validates ARP packets against trusted DHCP snooping bindings, which blocks forged mappings. Longer cache timeouts and disabling storm control would tend to worsen exposure.

Question 23Network Defense

Which element of a defense-in-depth architecture provides the earliest opportunity to detect a compromised internal host contacting the internet?

  1. Full disk encryption on endpoints
  2. Physical access controls at the data center
  3. Patch management for office productivity software
  4. Egress monitoring at the network boundary Correct answer.

Explanation

Outbound traffic must cross the boundary, so egress monitoring there observes malicious callbacks regardless of how the host was compromised. The other controls address different layers and do not inspect outbound flows.

Question 24Network Defense

When configuring a firewall rule base, which ordering practice reduces unintended exposure?

  1. Place all deny rules at the bottom regardless of scope
  2. Place broad allow rules first so traffic is handled quickly
  3. Order rules alphabetically by description
  4. Place specific deny rules for known malicious sources above broad allow rules Correct answer.

Explanation

Most firewalls evaluate rules top-down and stop at the first match, so specific denies must precede broad permits to take effect. Ordering by description or placing denies last allows broad permits to match first.

Question 25Network Defense

An organization observes a large spike in outbound traffic to a single external host at an unusual hour from a database server. Which first step best follows network defense practice?

  1. Preserve relevant flow and packet evidence, then scope the affected host and destination Correct answer.
  2. Block all outbound traffic from the entire data center permanently
  3. Immediately rebuild the database server without collecting evidence
  4. Ignore the event because database servers perform backups

Explanation

Evidence preservation before remediation keeps the investigation viable, and scoping identifies other affected systems and the external destination. Immediate rebuild or blanket blocking destroys evidence or causes disproportionate outage.

Question 26Network Defense

Which control most directly limits the ability of an internal host to reach command-and-control infrastructure on arbitrary external ports?

  1. Inbound stateful inspection on the DMZ firewall
  2. Spanning Tree Protocol root guard on access switches
  3. Network address translation of internal subnets
  4. Egress filtering on perimeter firewalls Correct answer.

Explanation

Egress filtering restricts which destinations and ports internal hosts may reach, so outbound callbacks to command-and-control servers on unusual ports are blocked or flagged. Inbound inspection, NAT, and STP guard do not govern outbound destination reachability.

Question 27Network Defense

An analyst wants to correlate a firewall deny event with the internal host that generated it. Which firewall log field is most essential for that correlation?

  1. The device uptime counter
  2. The interface duplex setting
  3. The rule hit count
  4. The translated source IP and port Correct answer.

Explanation

When NAT is in use, the original internal address may be hidden, so the translated source IP and port mapping is what ties a log entry back to a specific internal host. Rule counters, duplex, and uptime carry no host identity.

Question 28Network Defense

Which network segmentation approach best limits lateral movement after a workstation is compromised?

  1. Relying on host antivirus to block east-west traffic
  2. Extending a single flat VLAN across all floors for simpler administration
  3. Using a hub instead of a switch to observe internal traffic
  4. Placing servers and workstations in separate zones with deny-by-default inter-zone rules Correct answer.

Explanation

Zone separation with deny-by-default inter-zone policy forces traffic through inspection points and blocks unsolicited workstation-to-server connections, which is what constrains lateral movement. A flat VLAN, endpoint antivirus, and hubs do not enforce traffic policy between hosts.

Question 29Network Defense

Which protocol should replace Telnet for remote device administration to protect credentials in transit?

  1. HTTP
  2. SSH Correct answer.
  3. SNMPv1
  4. TFTP

Explanation

SSH encrypts the management session, so credentials and configuration commands are not readable on the wire. TFTP, SNMPv1, and HTTP all carry data in cleartext and expose credentials to capture.

Question 30Network Defense

A switch port serves a single workstation in a lobby. Which configuration most reduces the risk of an unauthorized device gaining network access through that port?

  1. Increasing the port MTU
  2. Enabling port security with a sticky MAC limit of one Correct answer.
  3. Disabling spanning tree on the port
  4. Setting the port to trunk mode

Explanation

Port security bound to a single learned MAC address causes the port to restrict or shut down when another device is attached, which blocks casual unauthorized connections. Trunking would expand access, and STP or MTU changes do not authenticate devices.

Question 31Network Defense

Which device function best describes a reverse proxy deployed in front of internal web servers?

  1. Terminating client connections and forwarding requests to backend servers Correct answer.
  2. Assigning dynamic IP addresses to internal clients
  3. Routing packets between VLANs using ACLs
  4. Resolving external DNS queries for clients

Explanation

A reverse proxy accepts client sessions on behalf of backend servers, shielding their identity and topology while centralizing TLS termination and filtering. DHCP, DNS resolution, and inter-VLAN routing are separate functions.

Question 32Network Defense

Which logging practice best supports reconstructing the sequence of a network intrusion after the fact?

  1. Enabling only error-level logging on perimeter devices
  2. Storing logs only on each device's local flash
  3. Synchronizing clocks with NTP and centralizing logs to a protected collector Correct answer.
  4. Rotating logs every hour with no archive

Explanation

Consistent timestamps and centralized, tamper-resistant collection let analysts order events across devices and preserve evidence an intruder cannot easily delete. Local-only storage, minimal logging, and short rotation without archives all degrade reconstruction.

Question 33Network Defense

Which practice hardens a perimeter firewall against unauthorized administrative changes?

  1. Enabling Telnet for management on the outside interface
  2. Using the same shared password for all administrators
  3. Allowing management from any internal subnet for convenience
  4. Restricting management access to a dedicated out-of-band network with strong authentication Correct answer.

Explanation

Limiting management to a dedicated, access-controlled network with individual strong authentication prevents both external and insider misuse of the firewall's control plane. Broad management reach, shared credentials, and cleartext Telnet all weaken that control.

Question 34Network Defense

A network IDS reports many alerts for the same signature against one host within minutes. Which step should an analyst take first to determine whether this is a true positive?

  1. Block the destination host at the firewall
  2. Review the raw packet or session data associated with the alerts Correct answer.
  3. Escalate to incident response without further checks
  4. Disable the signature to stop the noise

Explanation

Inspecting the underlying session data confirms whether the traffic actually matches the exploit pattern or is benign traffic that resembles the signature. Suppressing the rule, blocking hosts, or escalating prematurely skips the validation step and may cause harm or wasted effort.

Question 35Network Defense

An analyst sees repeated outbound connections from one workstation to many distinct external IP addresses on port 445. Which interpretation is most consistent with this pattern?

  1. The host is acting as an NTP time source
  2. The host is receiving inbound email
  3. The host may be scanning or propagating worm-like activity to SMB services Correct answer.
  4. The host is performing legitimate DNS resolution

Explanation

Many outbound SMB attempts to varied external addresses suggest scanning or self-propagating malware seeking exposed file-sharing services. DNS uses port 53, mail delivery uses port 25, and NTP uses port 123, so those services do not match the observed pattern.

Question 36Network Defense

Which firewall rule design most effectively prevents an attacker from reaching a management interface on a perimeter device?

  1. An explicit deny for management protocols on external interfaces placed above any permissive rule Correct answer.
  2. Using port knocking without any deny rule
  3. A permit rule for management from any source placed at the top of the policy
  4. Relying on the default any-any rule at the bottom

Explanation

An explicit deny placed above permissive rules ensures management protocols arriving from untrusted networks are dropped before broader rules can match. A top permit, reliance on a bottom default, and port knocking without a deny leave the interface reachable.

Question 37Network Defense

During an investigation, an analyst finds that internal hosts resolved a suspicious domain but no matching outbound connections appear in firewall logs. Which explanation is most plausible?

  1. The connection used an encrypted tunnel over an allowed port that the logs record only by port and address Correct answer.
  2. The hosts resolved the domain from cached records only
  3. The domain was never queried by any host
  4. The firewall was bypassed because DNS uses UDP

Explanation

Tunneling or encrypted traffic over an allowed port such as 443 can carry the actual command-and-control session while firewall logs show only address and port, so the domain resolution and the session appear unrelated. DNS caching or UDP transport would not explain a completed resolution with no observed session.

Question 38Network Defense

Which control best mitigates the risk of a rogue DHCP server handing out malicious gateway addresses on a user VLAN?

  1. DHCP snooping with trusted uplink ports Correct answer.
  2. Storm control on access ports
  3. Spanning Tree Protocol BPDU guard
  4. Dynamic ARP inspection alone

Explanation

DHCP snooping designates trusted ports toward legitimate servers and drops server replies arriving on untrusted access ports, which prevents rogue leases. ARP inspection, BPDU guard, and storm control address different Layer 2 threats.

Question 39Network Defense

An organization wants to detect hosts that begin communicating with newly registered domains. Which data combination is most useful?

  1. Firewall interface counters
  2. DNS query logs joined with domain registration age data Correct answer.
  3. Switch port duplex statistics
  4. Router CPU utilization graphs

Explanation

Joining DNS queries with registration age lets analysts flag resolutions of domains created very recently, a common trait of malicious infrastructure. Interface counters, duplex statistics, and CPU graphs describe device performance rather than domain reputation.

Question 40Network Defense

Which approach most effectively reduces the blast radius of a compromised jump host used for administrative access?

  1. Requiring per-session, time-bound credentials with session recording Correct answer.
  2. Disabling logging on the jump host to save storage
  3. Allowing the jump host to reach all internal subnets without restriction
  4. Granting the jump host a permanent domain administrator account

Explanation

Short-lived, per-session credentials plus recorded sessions limit what a compromised jump host can do and provide evidence of misuse. Permanent privileged accounts, unrestricted reach, and disabled logging all expand the impact.

Question 41Network Defense

A web server in a DMZ must retrieve updates from a vendor site. Which design best limits exposure while allowing the updates?

  1. A broad any-any egress rule for the DMZ subnet
  2. Inbound rules permitting the vendor to connect to the server
  3. Placing the server on the internal user VLAN
  4. A specific egress rule permitting only the vendor's addresses and ports from that server Correct answer.

Explanation

A narrowly scoped egress rule permits the required vendor communication while denying everything else, so a compromised server cannot freely reach the internet. Broad egress, inbound vendor access, and relocation to the user VLAN all increase risk.

Question 42Network Defense

Which indicator in NetFlow data most strongly suggests beaconing behavior by implanted malware?

  1. Continuous high-volume multicast traffic on the local segment
  2. A single large inbound transfer at midday
  3. Regularly spaced small outbound flows to the same external address Correct answer.
  4. Uniform distribution of flows across hundreds of destinations

Explanation

Beaconing appears as periodic, similarly sized outbound connections at consistent intervals to a fixed endpoint, reflecting a check-in schedule. Large one-off transfers, broad destination diversity, and local multicast do not show that regularity.

Question 43Network Defense

Which configuration change most directly prevents users on a guest wireless network from reaching internal corporate subnets?

  1. Placing guest traffic in a separate VLAN with ACLs denying access to internal ranges Correct answer.
  2. Enabling client isolation only between guest clients
  3. Increasing the guest DHCP lease time
  4. Enabling WPA3 on the guest SSID

Explanation

A dedicated guest VLAN combined with ACLs that deny access to internal address ranges enforces separation at Layer 3. WPA3 protects the wireless link, lease time is administrative, and client isolation only blocks guest-to-guest traffic.

Question 44Network Defense

An analyst must decide whether a blocked connection attempt represents reconnaissance or a misconfigured internal application. Which evidence is most decisive?

  1. Whether the connection used TCP rather than UDP
  2. Whether the destination host is powered on
  3. Whether the source host contacted many destinations and ports in a short window Correct answer.
  4. Whether the firewall logged the event at all

Explanation

Broad fan-out across many destinations and ports in a short period indicates systematic scanning rather than a single application reaching a wrong address. The mere existence of a log entry, destination power state, or transport protocol does not distinguish intent.

Question 45Network Defense

Which measure best protects data in transit between two data centers connected over an untrusted provider network?

  1. VLAN tagging across the provider handoff
  2. QoS marking on the provider link
  3. NAT at both site boundaries
  4. An IPsec tunnel between the site gateways Correct answer.

Explanation

IPsec provides confidentiality and integrity for traffic crossing a provider network that the organization does not control. VLAN tags, NAT, and QoS marking offer no cryptographic protection against interception.

Question 46Network Defense

A SIEM correlates a firewall deny, a DNS query for a suspicious domain, and an endpoint alert on the same host within two minutes. Which conclusion is best supported?

  1. The alerts are unrelated because they come from different sources
  2. The host is confirmed to be fully compromised and exfiltrating data
  3. The firewall caused the endpoint alert
  4. The host likely attempted contact with malicious infrastructure and the attempt was blocked Correct answer.

Explanation

Correlated events from independent sources on the same host in a short window support a probable attempted contact with malicious infrastructure, and the deny indicates the session was stopped. Confirmed compromise and exfiltration require evidence of successful sessions or data loss, and the correlation itself argues against unrelated alerts.

Question 47Network Defense

An analyst observes DNS responses containing unusually long TXT records to a single internal host at a steady rate. Which hypothesis best fits this evidence?

  1. A DHCP relay forwarding lease requests
  2. Normal reverse lookups for internal addresses
  3. Data exfiltration or command-and-control using DNS tunneling Correct answer.
  4. A misconfigured forwarder causing query loops

Explanation

Large, repeated TXT responses to one host are characteristic of tunneling, where data is encoded in DNS records to bypass egress controls. Forwarder loops, reverse lookups, and DHCP relay traffic do not produce sustained oversized TXT payloads.

Question 48Network Defense

A firewall policy permits outbound HTTPS from all internal hosts. Which compensating control best detects malicious use of that permitted channel?

  1. Increasing the firewall session table size
  2. Shortening DHCP lease durations
  3. TLS inspection with traffic analysis at the egress point Correct answer.
  4. Enabling NetBIOS name resolution

Explanation

Because HTTPS is broadly allowed, inspecting decrypted egress traffic for malicious patterns restores visibility that the permissive rule removed. Session table sizing, name resolution, and lease duration do not examine payload content.

Question 49Network Defense

An organization must choose between blocking and alerting for a signature with a high false-positive rate on business-critical traffic. Which approach best balances risk and operational load?

  1. Alert only and never revisit the rule
  2. Alert only, tune the signature against known-good traffic, then move to block once precision improves Correct answer.
  3. Block immediately and accept the disruption to critical services
  4. Disable the signature permanently to eliminate noise

Explanation

Alerting first preserves detection while the rule is tuned against legitimate traffic, and blocking is enabled once precision is acceptable. Immediate blocking risks outages, permanent disablement loses coverage, and never revisiting the rule leaves detection passive indefinitely.

Question 50Network Defense

A host inside the network receives inbound connections on a high port from many external addresses shortly after a public-facing service is attacked. Which explanation best fits this sequence?

  1. The internal host initiated a scan of external addresses
  2. The public service was compromised and used to establish a reverse shell or pivot into the internal host Correct answer.
  3. The external addresses are responding to the internal host's DNS queries
  4. The firewall applied NAT to inbound management traffic

Explanation

Inbound connections to an internal host following an attack on an exposed service suggest the service was compromised and used to pivot or establish a reverse channel. Outbound scanning, DNS responses, and NAT of management traffic do not match the direction and timing of the observed sessions.