I85PREP
⌘ K
ECSS study materials
ECSS study resources

ECSS practice questions

One question at a time. Build your ECSS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Defense Essentials

Which security control is best classified as preventive rather than detective or corrective?

  1. Capturing a packet trace to confirm a suspected data exfiltration
  2. Reviewing firewall logs for blocked connection attempts
  3. Deploying a host-based firewall rule that drops inbound SMB traffic Correct answer.
  4. Restoring a server from the last known good backup

Explanation

Preventive controls stop an event before it occurs, so a rule that drops inbound SMB traffic blocks the action outright. Log review and packet capture are detective because they observe activity after the fact, and backup restoration is corrective because it repairs damage already done.

Question 2Network Defense Essentials

In the defense-in-depth model, which layer is intended to limit lateral movement between hosts inside the same subnet?

  1. Endpoint antivirus signature updates
  2. Internal network segmentation with inter-zone access control Correct answer.
  3. Perimeter firewall filtering inbound internet traffic
  4. Physical badge access to the data center

Explanation

Defense in depth assumes the perimeter will eventually be breached, so internal segmentation controls traffic between zones and hosts to contain lateral movement. Perimeter filtering only governs the boundary, endpoint antivirus addresses malicious code, and physical access addresses the facility layer.

Question 3Network Defense Essentials

Which TCP flag combination is characteristic of a stealthy port scan that never completes the three-way handshake?

  1. SYN only Correct answer.
  2. FIN with ACK
  3. SYN with ACK
  4. PSH with URG

Explanation

A SYN scan sends a bare SYN and never sends the final ACK, so the handshake is left half-open. A closed port replies with RST while an open port replies with SYN-ACK, letting the scanner map services without completing connections.

Question 4Network Defense Essentials

A SOC analyst wants to detect hosts infected with malware that periodically contacts a hard-coded IP address at unpredictable intervals. Which detection approach is most appropriate?

  1. Comparing file hashes against a signature database
  2. Baselining normal outbound connection volumes per host and alerting on anomalies Correct answer.
  3. Enforcing a password complexity policy
  4. Reviewing Active Directory group membership changes

Explanation

Periodic beaconing to a fixed external address appears as anomalous outbound connection behavior relative to a per-host baseline. Hash matching only detects known files, and identity controls such as group review or password policy do not observe network beaconing.

Question 5Network Defense Essentials

Which statement correctly distinguishes an IDS from an IPS in inline deployment?

  1. Both devices must be deployed inline to function at all
  2. An IPS can drop malicious packets in real time, while an IDS only alerts after inspecting a copy of traffic Correct answer.
  3. An IDS sits inline and blocks traffic, while an IPS receives a mirrored copy of traffic
  4. An IPS relies solely on host agents, whereas an IDS inspects network packets

Explanation

An IPS is placed inline so it can drop or reset malicious traffic before delivery, whereas an IDS typically receives a copy of traffic from a SPAN port or tap and can only alert. This inline versus passive distinction is the core operational difference between the two.

Question 6Network Defense Essentials

An organization must retain full packet captures for forensic replay of a critical segment. Which placement achieves this with the least disruption to production traffic?

  1. Enabling port security on every access port
  2. Configuring a SPAN port on the switch to copy traffic to a capture host Correct answer.
  3. Inserting a transparent bridge inline on the segment
  4. Adding a second default gateway to the segment

Explanation

A SPAN port mirrors traffic to a capture host without sitting in the forwarding path, so captures are collected without risking outages. An inline bridge can capture traffic but introduces a failure point and possible latency on the production segment.

Question 7Network Defense Essentials

Which log source is most useful for identifying which user account was used in an authenticated attack against a Windows file server?

  1. Windows Security event logs with logon auditing enabled Correct answer.
  2. NetFlow records exported by the router
  3. SNMP interface counters from the switch
  4. DNS query logs from the recursive resolver

Explanation

Windows Security logs record logon events with the associated account name and logon type when auditing is enabled, which ties activity to an identity. NetFlow and SNMP describe traffic volumes, and DNS logs show name resolution rather than authentication.

Question 8Network Defense Essentials

A firewall rule set contains a permit-any rule at position 1 followed by specific deny rules. What is the primary security consequence?

  1. The firewall automatically reorders rules by specificity
  2. The permit-any rule consumes more CPU and is skipped
  3. The deny rules are evaluated first because deny takes precedence
  4. The specific deny rules are never reached, so traffic they target is permitted Correct answer.

Explanation

Most firewalls evaluate rules top-down and stop at the first match, so a permit-any rule at the top shadows every rule beneath it. The specific deny rules become unreachable and the traffic they were meant to block is allowed.

Question 9Network Defense Essentials

Which DMZ design best limits the impact of a compromised internet-facing web server?

  1. Sharing a single flat subnet between web, application, and database tiers
  2. Allowing the web server unrestricted outbound access to simplify patching
  3. Placing the web server on the internal user VLAN for easier administration
  4. Placing the web server in a segmented zone with tightly scoped rules to the internal database Correct answer.

Explanation

A segmented DMZ with narrowly scoped rules to the internal database limits what an attacker can reach from a compromised web tier. Flat or internal placement lets the compromised host pivot directly to user systems or other tiers.

Question 10Network Defense Essentials

Which characteristic most reliably indicates DNS tunneling in network logs?

  1. Numerous TXT or long subdomain queries to one domain with high entropy labels Correct answer.
  2. A small number of long-lived HTTPS sessions to a single content provider
  3. Frequent ARP broadcasts on the local segment
  4. Repeated NTP synchronization requests to pool servers

Explanation

DNS tunneling encodes data in query names, producing many queries with unusually long, high-entropy subdomain labels, often of TXT type, to a single domain. Normal HTTPS sessions, NTP polling, and ARP broadcasts do not exhibit that pattern.

Question 11Network Defense Essentials

What is the primary purpose of network access control (NAC) in a corporate LAN?

  1. Balancing load across multiple web servers
  2. Encrypting all traffic between endpoints and the gateway
  3. Enforcing endpoint compliance and identity before granting network access Correct answer.
  4. Providing name resolution for internal services

Explanation

NAC evaluates device identity and posture, such as patch level and antivirus state, before permitting access and can quarantine noncompliant hosts. Encryption, name resolution, and load balancing are handled by other technologies.

Question 12Network Defense Essentials

An analyst observes a host sending a single SYN to each of 1,024 sequential destination ports on one target within two seconds. Which conclusion is best supported?

  1. The host is experiencing a broadcast storm
  2. The host is performing a vertical port scan against one target Correct answer.
  3. The host is completing a large file transfer
  4. The host is performing a horizontal scan across many targets

Explanation

Many ports on a single destination in a short window indicate a vertical scan that enumerates services on one host. A horizontal scan would touch the same port across many different addresses instead.

Question 13Network Defense Essentials

Which control most directly mitigates ARP spoofing on a switched local network?

  1. Enabling Dynamic ARP Inspection with DHCP snooping bindings Correct answer.
  2. Configuring a default deny rule on the perimeter firewall
  3. Enabling SNMPv3 authentication on switches
  4. Deploying a signature-based antivirus on all endpoints

Explanation

Dynamic ARP Inspection validates ARP packets against trusted DHCP snooping bindings, so forged replies that map an attacker MAC to a victim IP are dropped. The other options address malware, external traffic, or management-plane authentication rather than local ARP integrity.

Question 14Network Defense Essentials

Which element of an incident response plan authorizes analysts to isolate a production server during an active intrusion?

  1. The vulnerability scan schedule
  2. The post-incident lessons-learned report
  3. Predefined escalation and containment authority documented in the plan Correct answer.
  4. The asset inventory spreadsheet

Explanation

Containment authority must be defined before an incident so analysts know who may isolate systems and under what conditions. Lessons-learned comes after resolution, while inventory and scan schedules are supporting references that grant no authority.

Question 15Network Defense Essentials

A web server in the DMZ must reach an internal database on TCP 1433. Which rule set follows least privilege?

  1. Permit any from the DMZ subnet to the internal network
  2. Permit all TCP from the DMZ to the database subnet
  3. Permit TCP 1433 from any source to the database subnet
  4. Permit TCP 1433 from the web server address to the database address only Correct answer.

Explanation

Least privilege restricts traffic to the specific source, destination, and port required, which here is the web server address to the database address on TCP 1433. Broader source or port ranges allow unnecessary reachability if the web server is compromised.

Question 16Network Defense Essentials

Which indicator in NetFlow data most strongly suggests data exfiltration over an established session?

  1. Periodic small inbound flows to the mail relay
  2. Short-lived connections to the internal DNS resolver
  3. A long-duration outbound flow to an unusual external address with a large byte ratio outbound versus inbound Correct answer.
  4. A brief spike in inbound connections to the public web tier during business hours

Explanation

Exfiltration typically appears as a sustained outbound session to an atypical destination carrying far more bytes outbound than inbound. Ordinary web traffic, mail delivery, and DNS resolution produce different flow shapes and destinations.

Question 17Network Defense Essentials

Why does a network tap generally provide more reliable capture than a SPAN port under heavy load?

  1. A tap assigns IP addresses to captured packets
  2. A tap receives a dedicated copy of the link and does not compete with switch resources or drop oversubscribed mirrored traffic Correct answer.
  3. A tap decrypts all TLS traffic automatically
  4. A tap filters malicious packets before they reach the capture host

Explanation

A tap sits on the physical link and delivers a full copy of traffic to the monitoring port, so mirrored traffic is not subject to switch CPU contention or oversubscription drops. A SPAN port can silently drop frames when the mirror exceeds port capacity.

Question 18Network Defense Essentials

Which practice best protects the integrity of log evidence collected during an investigation?

  1. Sharing log files through unauthenticated file shares
  2. Editing logs to remove noise before storage
  3. Storing logs only on the compromised host for convenience
  4. Computing and recording cryptographic hashes of collected logs at acquisition Correct answer.

Explanation

Hashing logs at acquisition creates a verifiable record that the evidence was not altered afterward, supporting admissibility and trust. Editing, storing on the compromised host, or using unauthenticated shares undermines integrity and chain of custody.

Question 19Network Defense Essentials

An attacker uses a compromised internal host to send crafted packets to a partner network, making the traffic appear to originate from the victim organization. Which threat does this describe?

  1. A brute-force attack against the partner's VPN gateway
  2. A man-in-the-middle attack on the partner's TLS session
  3. A pivot through the victim network to launder the attack's origin Correct answer.
  4. A reflected denial-of-service using spoofed source addresses

Explanation

Using a compromised host inside one network to launch traffic toward another disguises the true origin, which is a pivoting technique. Reflection involves spoofed sources in request packets, while MITM and brute force describe different mechanisms entirely.

Question 20Network Defense Essentials

Which measure best reduces the attack surface exposed by unnecessary services on internet-facing hosts?

  1. Enabling verbose debugging on all applications
  2. Disabling unused services and closing their associated ports Correct answer.
  3. Increasing password length for administrator accounts
  4. Adding more bandwidth to the internet link

Explanation

Every listening service is a potential entry point, so disabling unneeded services and closing their ports directly shrinks the attack surface. Password length, bandwidth, and debugging affect other risk areas or can increase exposure.

Question 21Network Defense Essentials

A SIEM correlates a spike in failed VPN logons followed by a successful logon from a new country. Which detection concept does this illustrate?

  1. Signature matching on a single event
  2. Correlation of multiple events across sources to identify a compound pattern Correct answer.
  3. Vulnerability scanning of the VPN concentrator
  4. Static allowlisting of source addresses

Explanation

The SIEM joins authentication events from different times and locations into a compound pattern that is more meaningful than any single event. Signature matching alone would not link the failures to the later foreign success.

Question 22Network Defense Essentials

Which cryptographic protocol replaced WEP because WEP's static keys and weak IV handling allowed rapid key recovery?

  1. WPA2 using AES-CCMP with per-session keys Correct answer.
  2. PPTP with MS-CHAPv2
  3. Telnet with a shared password
  4. SNMPv1 with a community string

Explanation

WPA2 with AES-CCMP uses per-session keys and a stronger encryption mode, removing the static-key and IV weaknesses that made WEP trivially crackable. The other options are either obsolete or unrelated protocols that provide no equivalent wireless protection.

Question 23Network Defense Essentials

An analyst sees repeated ICMP echo requests with a payload of several hundred bytes to many external hosts from one internal server. Which hypothesis is most plausible?

  1. Normal time synchronization with an NTP pool
  2. Covert channel or beaconing using ICMP payloads Correct answer.
  3. A DHCP address lease renewal storm
  4. A legitimate backup to an offsite repository

Explanation

ICMP echo payloads are normally small and infrequent; large payloads sent to many external hosts suggest data hidden in the payload or beaconing behavior. NTP, DHCP, and backup traffic use different protocols and patterns.

Question 24Network Defense Essentials

Which practice most improves the usefulness of firewall logs for later investigation?

  1. Deleting logs older than one day to save disk space
  2. Storing logs only in volatile memory on the firewall
  3. Logging only denied traffic to reduce volume
  4. Synchronizing device clocks to a common time source and logging allowed and denied traffic with rule identifiers Correct answer.

Explanation

Accurate timelines require synchronized clocks, and recording both allowed and denied traffic with rule identifiers lets investigators reconstruct what happened and which policy applied. Truncating retention or logging only denials leaves critical gaps.

Question 25Network Defense Essentials

What is the primary role of a honeypot in network defense?

  1. Encrypting traffic between internal segments
  2. Blocking all traffic from known malicious addresses
  3. Replacing the perimeter firewall with a decoy
  4. Attracting and observing attacker activity to gather intelligence and raise alerts Correct answer.

Explanation

A honeypot is a decoy system with no legitimate production role, so any interaction with it is suspicious and can be studied for tactics and tooling. It does not block traffic, encrypt segments, or substitute for perimeter filtering.

Question 26Network Defense Essentials

Which security control is designed to inspect and filter traffic between two networks at different trust levels?

  1. A hub that repeats every frame to all connected ports
  2. A patch management server inside the server subnet
  3. A UPS that keeps switches powered during an outage
  4. A stateful firewall placed at the boundary between the zones Correct answer.

Explanation

A firewall enforces an access control policy on traffic crossing a trust boundary, tracking connection state so only permitted flows pass. Devices such as hubs and UPS units affect delivery or availability, not policy enforcement between zones.

Question 27Network Defense Essentials

Which protocol and port combination should be permitted inbound on a firewall to allow remote administrative shell access to a Linux server?

  1. UDP 53
  2. TCP 22 Correct answer.
  3. TCP 445
  4. TCP 443

Explanation

SSH listens on TCP 22 by default and provides encrypted remote shell access to Linux hosts. The other ports correspond to HTTPS, DNS, and SMB respectively, none of which is the standard remote shell service.

Question 28Network Defense Essentials

Which technique segments a flat corporate LAN so that hosts in different departments cannot reach each other directly at layer 2?

  1. Disabling spanning tree on the core switch
  2. Increasing the DHCP lease time for all clients
  3. Deploying VLANs with inter-VLAN routing controlled by a firewall Correct answer.
  4. Enabling LLDP on all access switches

Explanation

VLANs create separate broadcast domains, and routing between them can be forced through a firewall so policy is applied. The other options affect address lifetime, neighbor discovery, or loop prevention and do not isolate hosts.

Question 29Network Defense Essentials

Which record type in a SIEM should an analyst use to review activity over time for a specific internal host?

  1. A one-time vulnerability scan report
  2. A retained log archive indexed by host and time Correct answer.
  3. A printed network diagram
  4. A configuration baseline document

Explanation

Historical investigation depends on retained logs that can be queried by host and time range. Scans, diagrams, and baselines describe state at a point in time but do not record ongoing activity.

Question 30Network Defense Essentials

What does the principle of least privilege require when writing a firewall rule permitting an application flow?

  1. Permit only the specific source, destination, port, and protocol required Correct answer.
  2. Permit the flow only during business hours regardless of need
  3. Permit all traffic from the application subnet to simplify auditing
  4. Permit the widest source range available to avoid future changes

Explanation

Least privilege means allowing exactly the endpoints and service needed and nothing more, which limits the blast radius if a host is compromised. Broad permits or blanket subnet rules grant far more access than the application requires.

Question 31Network Defense Essentials

Which device forwards frames only to the switch port where the destination MAC address is known?

  1. A patch panel
  2. A layer 2 switch Correct answer.
  3. A network tap
  4. A media converter

Explanation

A switch learns MAC addresses per port and forwards unicast frames only toward the port associated with the destination. Taps, converters, and patch panels are passive or physical-layer components without forwarding logic.

Question 32Network Defense Essentials

Which practice ensures that firewall rule changes can be traced to an authorized request?

  1. Requiring a change ticket and peer review before deployment Correct answer.
  2. Applying changes directly during peak hours
  3. Backing up rules once per year
  4. Storing rules only on the device console

Explanation

A documented change request with independent review creates accountability and catches errors before deployment. Console-only edits, peak-hour changes, and infrequent backups leave no reliable audit trail or safety net.

Question 33Network Defense Essentials

Which security objective is served by keeping a tested offline copy of firewall and router configurations?

  1. Non-repudiation of administrator actions
  2. Integrity of DNS zone transfers
  3. Availability of a known-good configuration for rapid recovery Correct answer.
  4. Confidentiality of user passwords in transit

Explanation

A validated offline copy lets the team restore a device quickly after failure or tampering, supporting availability and recovery. It does not by itself provide transit confidentiality, action non-repudiation, or zone-transfer integrity.

Question 34Network Defense Essentials

An analyst needs to determine whether a suspected intrusion crossed from the DMZ into the internal database tier. Which evidence combination best answers this?

  1. Wireless controller association logs
  2. Email gateway spam scores
  3. Antivirus alerts on employee workstations
  4. Firewall session logs correlating DMZ source addresses with database destination addresses Correct answer.

Explanation

Firewall session records show which source reached which destination and port, directly evidencing a DMZ-to-database flow. Workstation antivirus, wireless association, and spam data do not describe inter-zone connections.

Question 35Network Defense Essentials

A switch port security policy allows only one MAC address per access port. Which attack does this most directly hinder?

  1. DNS cache poisoning of a resolver
  2. BGP route hijacking
  3. MAC flooding that exhausts the CAM table Correct answer.
  4. TLS downgrade during handshake

Explanation

Limiting learned MAC addresses per port prevents an attacker from flooding the switch with bogus source addresses to overflow the forwarding table. DNS, BGP, and TLS attacks operate at other layers and are unaffected by port MAC limits.

Question 36Network Defense Essentials

Which configuration on a DNS resolver reduces the chance that clients accept forged responses from an off-path attacker?

  1. Disabling DNSSEC validation to speed lookups
  2. Using randomized source ports and query IDs with DNSSEC validation enabled Correct answer.
  3. Setting a single fixed source port for all queries
  4. Allowing recursive queries from any internet address

Explanation

Randomized query identifiers and source ports make blind spoofing far harder, and DNSSEC validation lets the resolver reject unauthenticated answers. Fixed ports, open recursion, and disabled validation all weaken spoofing resistance.

Question 37Network Defense Essentials

A host on the internal network begins making outbound connections to many distinct external IP addresses on TCP 443 at a steady rate. Which hypothesis should the analyst evaluate first?

  1. A backup job to a known internal server
  2. A scheduled operating system update from a single vendor
  3. A user browsing a single website
  4. Beaconing to command-and-control infrastructure Correct answer.

Explanation

Regular outbound connections to many unrelated external addresses on a common port fit the pattern of command-and-control beaconing or distributed payload retrieval. A single vendor update, one website, or an internal backup would not produce that fan-out pattern.

Question 38Network Defense Essentials

Which approach best protects management interfaces of network devices from internet exposure?

  1. Publishing them on public IP addresses with strong passwords
  2. Enabling Telnet for compatibility with legacy tools
  3. Relying on the default administrative account name
  4. Restricting access to a dedicated management VLAN reachable through a jump host Correct answer.

Explanation

Management planes should sit on a separate VLAN reachable only through an authenticated jump host, removing direct internet exposure. Public addressing, Telnet, and default accounts all increase the risk of compromise.

Question 39Network Defense Essentials

Which control best detects unauthorized changes to a perimeter router's running configuration?

  1. Increasing the console baud rate
  2. Enabling CDP on all interfaces
  3. Rotating the enable password monthly
  4. Comparing the running configuration against an approved baseline on a schedule Correct answer.

Explanation

Periodic comparison with an approved baseline reveals drift or tampering that would otherwise go unnoticed. Baud rate, CDP, and password rotation do not provide configuration integrity checking.

Question 40Network Defense Essentials

An organization wants to detect lateral movement inside a data center without relying on endpoint agents. Which data source is most appropriate?

  1. East-west traffic metadata from virtual switches and internal firewalls Correct answer.
  2. Physical badge reader records
  3. Perimeter email filtering logs
  4. Public threat intelligence feeds alone

Explanation

Lateral movement appears as server-to-server connections inside the data center, so east-west flow metadata from virtual switches and internal firewalls is the direct source. Email, external feeds, and badge records do not show internal network sessions.

Question 41Network Defense Essentials

Which measure most effectively limits the damage an attacker can cause after compromising a user workstation?

  1. Disabling host firewalls to simplify troubleshooting
  2. Allowing workstations to initiate SMB to all server subnets
  3. Giving workstations static public IP addresses
  4. Placing workstations in a segment that can reach only approved internal services Correct answer.

Explanation

Constraining what a workstation can reach limits an attacker's options for pivoting after compromise. Public addressing, disabled host firewalls, and broad SMB access all increase post-compromise reach.

Question 42Network Defense Essentials

An IDS reports a signature match on traffic that later proves to be a benign internal test. How should the analyst classify the alert?

  1. True positive requiring containment
  2. True negative requiring no action
  3. False positive requiring tuning Correct answer.
  4. False negative requiring escalation

Explanation

A signature fired on legitimate activity, so the alert is a false positive and the rule or threshold should be tuned. It is not a true positive because no malicious event occurred, and false negative or true negative describe different outcomes.

Question 43Network Defense Essentials

Which logging design best supports correlating events across firewalls, proxies, and domain controllers?

  1. Synchronizing all devices to a common reliable time source and forwarding to a central collector Correct answer.
  2. Disabling logging on high-volume devices
  3. Using different timestamp formats on each platform
  4. Storing logs only locally on each device with default retention

Explanation

Correlation requires consistent, accurate timestamps and a central store where events from multiple sources can be joined. Local-only storage, mixed formats, and disabled logging all undermine correlation.

Question 44Network Defense Essentials

Which technique helps an analyst distinguish a port scan from normal connection attempts in firewall logs?

  1. Inspecting the physical cable labeling
  2. Reviewing the device's uptime counter
  3. Counting distinct destination ports contacted by one source within a short window Correct answer.
  4. Checking the firewall firmware version

Explanation

A scan is characterized by one source touching many destination ports or hosts quickly, which a port-count-over-time query reveals. Uptime, firmware, and cabling details say nothing about connection patterns.

Question 45Network Defense Essentials

A file transfer from an internal server to an external host occurs outside business hours and matches the size of a recently accessed database export. Which conclusion is best supported?

  1. The event warrants immediate investigation as possible data exfiltration Correct answer.
  2. The event proves the firewall is misconfigured
  3. The event indicates a hardware failure
  4. The event is certainly a scheduled backup and can be closed

Explanation

An off-hours outbound transfer sized to match sensitive data is a strong exfiltration indicator and should be investigated promptly. It cannot be assumed benign, and it does not by itself prove a firewall error or hardware fault.

Question 46Network Defense Essentials

An attacker poisons a switch's CAM table so unicast frames flood to all ports. Which mitigation most directly restores confidentiality of switched traffic?

  1. Enabling jumbo frames on uplinks
  2. Increasing the number of VLANs on the switch
  3. Shortening the DHCP lease duration
  4. Enforcing port security with MAC address limits and sticky entries Correct answer.

Explanation

Port security caps the number of learned addresses per port, preventing the table from being overflowed and traffic from being flooded. Additional VLANs, jumbo frames, and shorter leases do not stop CAM table exhaustion.

Question 47Network Defense Essentials

Which design decision most reduces the risk of a single compromised reverse proxy granting access to every backend application?

  1. Placing each application behind its own proxy instance with distinct credentials and network policy Correct answer.
  2. Allowing the proxy unrestricted access to all internal subnets
  3. Consolidating all applications behind one proxy with a shared administrative account
  4. Storing backend credentials in a world-readable file on the proxy

Explanation

Separate proxy instances with distinct credentials and scoped network policy contain a compromise to one application. Shared administrative accounts, exposed credential files, and unrestricted internal access turn one breach into a network-wide one.

Question 48Network Defense Essentials

An analyst observes periodic outbound DNS queries to the same domain with high-entropy subdomains and consistent response sizes. Which control best reduces the impact of this activity?

  1. Increasing the resolver cache TTL for all records
  2. Disabling DNS logging to reduce storage costs
  3. Allowing any internal host to query external resolvers directly
  4. Blocking the domain at the resolver and restricting outbound DNS to approved resolvers Correct answer.

Explanation

High-entropy subdomains in repeating queries fit DNS tunneling, so blocking the domain and forcing all queries through monitored approved resolvers cuts the channel and preserves visibility. Direct external queries, disabled logging, and longer TTLs all weaken detection and control.

Question 49Network Defense Essentials

Which combination best protects an internet-facing web tier while preserving the ability to investigate an intrusion?

  1. Web servers exposed directly with host firewalls disabled
  2. A reverse proxy with WAF inspection in front of the web servers plus full session logging to a central collector Correct answer.
  3. A reverse proxy with logging retained only on the proxy's local disk
  4. Direct exposure of web servers with logging disabled for performance

Explanation

A reverse proxy with WAF inspection filters malicious requests, and centralized session logging preserves the evidence needed for investigation even if a host is compromised. Direct exposure, disabled logging, and local-only retention undermine both goals.

Question 50Network Defense Essentials

A SIEM rule alerts whenever an internal host contacts a newly registered external domain. Analysts report heavy noise from legitimate software updates. Which refinement best improves signal quality without losing coverage?

  1. Raise the alert threshold so the rule never fires
  2. Add allowlisting for verified vendor update domains and exclude them from the rule Correct answer.
  3. Remove internal host context from the alert output
  4. Disable the rule entirely to eliminate the noise

Explanation

Allowlisting known-good vendor domains suppresses the documented benign cause while keeping detection for other newly registered domains. Disabling the rule, preventing it from firing, or stripping host context destroys detection value.