I85PREP
⌘ K
IBM Cybersecurity Analyst study materials
IBM Cybersecurity Analyst study resources

IBM Cybersecurity Analyst practice questions

One question at a time. Build your IBM Cybersecurity Analyst understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cybersecurity Foundations and Threat Landscape

In the CIA triad, which property is violated when an attacker silently modifies records in a database without being detected?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Availability
  4. Confidentiality

Explanation

Integrity concerns the accuracy and completeness of data, so unauthorized alteration of records is an integrity violation. Confidentiality would be breached by disclosure, and availability by disruption of access. Non-repudiation is a related assurance property rather than one of the three core triad elements.

Question 2Cybersecurity Foundations and Threat Landscape

A security analyst classifies an intruder who breaks into systems purely for intellectual challenge and public recognition, with no financial motive, as which threat actor type?

  1. Hacktivist Correct answer.
  2. Nation-state actor
  3. Script kiddie
  4. Organized crime group

Explanation

Hacktivists are driven by ideological or reputational motives and often seek publicity for their exploits. Financial gain characterizes organized crime, while nation-state actors pursue strategic or intelligence objectives. A script kiddie is defined by low skill using existing tools, not by motivation.

Question 3Cybersecurity Foundations and Threat Landscape

Which malware characteristic distinguishes a worm from a virus?

  1. A worm hides inside the boot sector and activates only on system restart.
  2. A worm encrypts user files and demands payment for the decryption key.
  3. A worm self-propagates across networks without requiring a host file or user action. Correct answer.
  4. A worm spreads exclusively through email attachments opened by the recipient.

Explanation

The defining trait of a worm is autonomous propagation across networks without attaching to a host program or needing user interaction. Viruses require a host file and typically some user action to spread. Ransomware behavior and boot-sector persistence are separate characteristics unrelated to the worm definition.

Question 4Cybersecurity Foundations and Threat Landscape

Which security control is best classified as preventive rather than detective or corrective?

  1. A log review conducted during a weekly audit
  2. A backup restoration performed after data loss
  3. A firewall rule that blocks inbound traffic on port 23 Correct answer.
  4. An IDS alert generated when a signature matches

Explanation

Preventive controls stop an event before it occurs, and a firewall rule denying Telnet traffic does exactly that. IDS alerts and log reviews are detective because they identify activity after it happens. Backup restoration is corrective because it recovers after damage.

Question 5Cybersecurity Foundations and Threat Landscape

Which term describes the assurance that a party cannot credibly deny having performed an action such as authorizing a transaction?

  1. Accounting
  2. Authentication
  3. Authorization
  4. Non-repudiation Correct answer.

Explanation

Non-repudiation provides proof of the origin and integrity of an action so the actor cannot later deny it, typically using digital signatures. Authentication verifies identity, authorization grants permissions, and accounting records usage. Only non-repudiation addresses the inability to deny an action.

Question 6Cybersecurity Foundations and Threat Landscape

Which phase of the incident response lifecycle involves containing damage and eliminating the root cause before returning systems to service?

  1. Eradication and recovery Correct answer.
  2. Preparation
  3. Detection and analysis
  4. Post-incident activity

Explanation

Eradication removes the cause of the incident, and recovery restores affected systems to normal operation, both following containment. Preparation builds capability before incidents occur, detection identifies them, and post-incident activity captures lessons learned. Containment and root-cause removal therefore belong to the eradication and recovery phase.

Question 7Cybersecurity Foundations and Threat Landscape

Which description matches a zero-day vulnerability?

  1. A flaw that is disclosed by the vendor together with an immediate patch.
  2. A flaw that is exploited before a vendor patch or mitigation is publicly available. Correct answer.
  3. A flaw that only affects systems that have never been connected to a network.
  4. A flaw that has been known publicly for more than one year without exploitation.

Explanation

A zero-day vulnerability is one exploited before defenders have a patch or mitigation, giving defenders zero days of warning. Long-known unpatched flaws have existing fixes and are not zero-days. Vendor-coordinated disclosure with an available patch is the opposite of the zero-day situation.

Question 8Cybersecurity Foundations and Threat Landscape

Which attack manipulates a user into revealing credentials by impersonating a trusted entity through a deceptive message?

  1. SQL injection
  2. Phishing Correct answer.
  3. Port scanning
  4. Privilege escalation

Explanation

Phishing is a social engineering attack that impersonates a trusted party to trick a user into disclosing information or taking an unsafe action. Port scanning is reconnaissance, privilege escalation raises access level after a compromise, and SQL injection targets database queries. Only phishing relies on deceiving the user directly.

Question 9Cybersecurity Foundations and Threat Landscape

An attacker sends crafted input to a web application, causing it to execute operating system commands on the server. Which weakness does this exploit?

  1. Weak password policy applied to service accounts
  2. Unsanitized user input passed to a command interpreter Correct answer.
  3. Missing encryption of data at rest on the database server
  4. Absence of multi-factor authentication for administrators

Explanation

Command injection occurs when untrusted input reaches a shell or command interpreter without validation, letting the attacker run arbitrary commands. Missing encryption, weak authentication, and password policy problems are real weaknesses but do not cause command execution through input handling. The root cause here is improper input handling at the interpreter boundary.

Question 10Cybersecurity Foundations and Threat Landscape

A user receives a text message claiming to be from a bank and is directed to a lookalike login page. Which term most precisely describes this attack?

  1. Smishing Correct answer.
  2. Vishing
  3. Whaling
  4. Spear phishing

Explanation

Smishing is phishing delivered over SMS or text messaging, which matches the scenario. Vishing uses voice calls, whaling targets senior executives, and spear phishing is a tailored email attack against a specific individual. The delivery channel of a text message makes smishing the precise term.

Question 11Cybersecurity Foundations and Threat Landscape

During reconnaissance, an attacker queries public DNS records, WHOIS data, and job postings to learn about an organization's infrastructure. Which best describes this activity?

  1. Lateral movement across compromised internal hosts
  2. Exploitation of a known remote code execution flaw
  3. Active scanning that directly probes target hosts
  4. Passive information gathering using open sources Correct answer.

Explanation

Collecting DNS, WHOIS, and job-posting data from public sources is passive reconnaissance because it does not directly interact with the target's systems. Active scanning sends packets to target hosts, exploitation leverages a vulnerability, and lateral movement occurs after initial compromise. The defining feature here is reliance on open-source information without touching target infrastructure.

Question 12Cybersecurity Foundations and Threat Landscape

A ransomware incident encrypts file servers, and the organization restores from offline backups. Which control type does the restoration represent?

  1. Deterrent
  2. Detective
  3. Preventive
  4. Corrective Correct answer.

Explanation

Corrective controls restore systems and data after an adverse event, which is exactly what backup restoration does following ransomware encryption. Preventive controls block events, detective controls identify them, and deterrent controls discourage attackers. Restoration acts after the damage, so it is corrective.

Question 13Cybersecurity Foundations and Threat Landscape

An analyst observes a compromised host beaconing to an external command-and-control server at regular intervals. Which malware capability does this indicate?

  1. Persistence through a modified boot sector
  2. Remote command and control by an operator Correct answer.
  3. Local privilege escalation on the host
  4. Disk encryption of user files

Explanation

Periodic outbound beacons to an external server indicate command-and-control communication, allowing an operator to task the implant. Privilege escalation, file encryption, and boot-sector persistence are separate capabilities that do not require recurring external contact. The regular beaconing pattern is the signature of C2 activity.

Question 14Cybersecurity Foundations and Threat Landscape

Which practice most directly reduces an organization's exposure to supply chain risk from third-party software?

  1. Requiring annual password changes for all employees
  2. Increasing the frequency of antivirus signature updates on servers
  3. Verifying software integrity and reviewing vendor security posture before deployment Correct answer.
  4. Disabling all outbound network traffic from developer workstations

Explanation

Supply chain risk stems from trust placed in external providers, so verifying integrity and assessing vendor security practices addresses that risk at its source. Blocking developer traffic, rotating passwords, and updating signatures are useful hygiene measures but do not evaluate third-party software trust. Only vendor assessment and integrity verification directly target supply chain exposure.

Question 15Cybersecurity Foundations and Threat Landscape

An attacker intercepts and alters communications between two parties who believe they are talking directly to each other. Which attack is this?

  1. Directory traversal
  2. Denial of service
  3. On-path attack Correct answer.
  4. Cross-site scripting

Explanation

An on-path attack, historically called man-in-the-middle, places the attacker between two parties to intercept or modify traffic. Denial of service disrupts availability, cross-site scripting injects scripts into web pages, and directory traversal accesses files outside an intended path. Only the on-path attack involves relaying altered traffic between two unaware parties.

Question 16Cybersecurity Foundations and Threat Landscape

Which indicator most strongly suggests a system is infected with a rootkit?

  1. The system clock drifts by several seconds per day
  2. Tool output and log entries disagree with independently observed system behavior Correct answer.
  3. Antivirus definitions are several days out of date
  4. A single application crashes when opening a large file

Explanation

Rootkits hide by subverting the operating system, so utilities and logs may report a clean state that conflicts with behavior observed through independent means. Clock drift, an application crash, and stale definitions are common issues that do not indicate deep concealment. Inconsistency between reported and observed reality is the classic rootkit indicator.

Question 17Cybersecurity Foundations and Threat Landscape

A web application accepts a filename parameter and returns contents of files outside the web root when the value contains '../'. Which vulnerability is present?

  1. Cross-site request forgery
  2. Open redirect
  3. Path traversal Correct answer.
  4. Insecure deserialization

Explanation

Path traversal exploits insufficient validation of file path input so that sequences like '../' reach files outside the intended directory. CSRF abuses a victim's authenticated session, deserialization attacks untrusted serialized data, and open redirect forwards users to arbitrary URLs. Accessing files outside the web root through manipulated paths is path traversal.

Question 18Cybersecurity Foundations and Threat Landscape

An organization wants to reduce the window between an attacker's initial access and detection. Which capability most directly addresses this goal?

  1. Continuous endpoint monitoring with behavioral detection rules Correct answer.
  2. Annual penetration testing of the external perimeter
  3. Quarterly password complexity reviews
  4. Static firewall rules reviewed once per year

Explanation

Continuous behavioral monitoring on endpoints shortens dwell time by detecting suspicious activity soon after initial access. Annual penetration tests and yearly firewall reviews are point-in-time activities that leave long gaps. Password complexity reviews address credential strength, not detection speed.

Question 19Cybersecurity Foundations and Threat Landscape

Which threat modeling approach systematically enumerates assets, trust boundaries, and threats by decomposing a system before identifying mitigations?

  1. Fuzzing
  2. CVSS scoring
  3. Log correlation
  4. STRIDE Correct answer.

Explanation

STRIDE is a threat modeling framework that categorizes threats while decomposing a system across trust boundaries, guiding mitigation design. CVSS scores the severity of individual vulnerabilities, fuzzing tests software with malformed input, and log correlation supports detection. Only STRIDE is a structured threat modeling methodology.

Question 20Cybersecurity Foundations and Threat Landscape

A security team finds that an attacker used valid stolen credentials over a VPN and behaved like a normal user for weeks. Which detection strategy is most effective against this pattern?

  1. Increasing the VPN session timeout to eight hours
  2. Blocking all VPN access from outside the country
  3. User and entity behavior analytics flagging anomalous access patterns Correct answer.
  4. Signature-based antivirus scanning of the VPN concentrator

Explanation

Because the attacker used legitimate credentials, signature-based tools see nothing unusual; behavior analytics detects deviations such as odd hours, unusual data volumes, or new resource access. Antivirus on the concentrator cannot see user behavior, geographic blocking is easily bypassed, and longer timeouts worsen exposure. Anomaly detection targets the misuse of valid accounts.

Question 21Cybersecurity Foundations and Threat Landscape

Which statement correctly distinguishes a vulnerability from a risk?

  1. A risk exists only when a vulnerability has already been exploited successfully.
  2. A vulnerability is the probability of loss, while risk is the technical flaw itself.
  3. A vulnerability is a weakness, while risk combines the likelihood and impact of that weakness being exploited. Correct answer.
  4. A vulnerability always produces risk regardless of exposure or existing controls.

Explanation

A vulnerability is a weakness in a system, whereas risk expresses the potential for loss by combining threat likelihood and impact with the weakness. Risk depends on exposure and controls, so an unexposed vulnerability may pose little risk. Risk exists before exploitation, not only after an incident.

Question 22Cybersecurity Foundations and Threat Landscape

An analyst must prioritize remediation for two findings: a critical-severity flaw on an internet-facing server and a critical-severity flaw on an isolated lab machine with no network access. Which reasoning best supports prioritization?

  1. Fix the internet-facing server first because its exposure raises the likelihood of exploitation. Correct answer.
  2. Treat both equally because severity ratings are identical.
  3. Fix the lab machine first because isolated systems cannot receive patches.
  4. Defer both until the next annual assessment cycle.

Explanation

Risk prioritization considers exposure and threat likelihood alongside severity, so an internet-facing host with the same severity carries greater risk. Isolation reduces the likelihood of exploitation on the lab machine. Equal severity scores do not imply equal risk, and deferring remediation increases exposure.

Question 23Cybersecurity Foundations and Threat Landscape

A defender observes encrypted DNS queries to an unusual external resolver shortly after a workstation opened a malicious document. Which interpretation is most defensible?

  1. The resolver may be a covert channel used for command and control or data exfiltration. Correct answer.
  2. The traffic indicates a hardware failure in the network interface.
  3. The workstation is performing routine operating system updates.
  4. The queries prove the workstation has been fully patched.

Explanation

Malicious documents frequently launch implants that use DNS tunneling or an unusual resolver to evade inspection, so the timing and destination are suspicious. Update traffic typically goes to vendor endpoints over standard protocols, hardware faults do not produce DNS queries, and patching status is unrelated. The combination of a malicious document and unusual encrypted DNS points to covert communication.

Question 24Cybersecurity Foundations and Threat Landscape

An organization discovers that an attacker maintained access for months using a compromised service account with excessive privileges. Which combination of controls best reduces recurrence?

  1. Full-disk encryption on servers plus quarterly vulnerability scans
  2. Web application firewalls plus monthly patch reports
  3. Least privilege for service accounts plus monitoring of privileged account behavior Correct answer.
  4. Longer, more complex passwords for all users plus annual awareness training

Explanation

The incident combined excessive privilege with prolonged undetected misuse, so reducing service account rights and monitoring privileged behavior addresses both causes. Password complexity, encryption, scanning, and patching improve general hygiene but do not constrain or observe privileged account misuse. Least privilege limits blast radius while monitoring shortens dwell time.

Question 25Cybersecurity Foundations and Threat Landscape

A phishing campaign targets only the finance team, uses details from a recent public filing, and avoids antivirus detection by linking to a credential-harvesting site. Which characterization is most accurate?

  1. A supply chain compromise of the filing system's software vendor
  2. An untargeted mass-mailing worm that self-propagates through attachments
  3. A denial-of-service attempt against the finance department's mail server
  4. A targeted spear-phishing campaign using pretexting and a credential-harvesting lure Correct answer.

Explanation

The campaign is tailored to a specific group, uses researched context as a pretext, and directs victims to a credential-harvesting page rather than a malicious attachment. It does not self-propagate, disrupt availability, or tamper with vendor software. These traits define targeted spear phishing with pretexting.

Question 26Cybersecurity Foundations and Threat Landscape

Which security concept describes the principle that a user should be granted only the access rights required to perform their assigned job duties and nothing more?

  1. Separation of duties
  2. Defense in depth
  3. Mandatory access control
  4. Least privilege Correct answer.

Explanation

Least privilege limits each account to the minimum permissions needed for its tasks, which shrinks the blast radius if credentials are compromised. Separation of duties instead divides a sensitive task among multiple people, defense in depth layers controls, and mandatory access control is a policy-enforcement model based on labels.

Question 27Cybersecurity Foundations and Threat Landscape

An organization classifies its data so that handling rules follow the information itself wherever it is copied or shared. Which characteristic of the classification scheme does this describe?

  1. Labels apply only to email attachments
  2. Labels persist with the data and travel with it Correct answer.
  3. Labels expire automatically after one year
  4. Labels are assigned only at the storage location

Explanation

A sound data classification scheme attaches the label to the data itself so that protection requirements follow the information across systems, copies, and sharing channels. If labels were tied only to a storage location or a single channel, the same data would lose its handling rules once moved or transmitted elsewhere.

Question 28Cybersecurity Foundations and Threat Landscape

A security analyst reviews a firewall log and sees repeated inbound connection attempts to TCP port 445 from a single external address across many internal hosts. Which interpretation best fits this activity?

  1. A user is downloading email over an encrypted channel
  2. A backup job is replicating data to an offsite server
  3. An internal host is resolving DNS names through an external resolver
  4. An external host is scanning for exposed SMB services to exploit Correct answer.

Explanation

Port 445 carries SMB, and repeated attempts from one external source toward many internal hosts is characteristic of service discovery preceding exploitation. DNS resolution would target port 53, backup replication would typically originate internally toward a known server, and encrypted email retrieval would use ports such as 993 rather than 445.

Question 29Cybersecurity Foundations and Threat Landscape

An employee plugs an unauthorized USB drive into a workstation, and malware from the drive infects the host before any signature update is available. Which control category would most directly have prevented the infection?

  1. Detective controls that alert after malware executes
  2. Corrective controls that restore the host from backup
  3. Technical controls restricting removable media and blocking unauthorized devices Correct answer.
  4. Compensating controls that shorten the backup schedule

Explanation

Preventive technical controls such as device control policies and endpoint rules that block unapproved removable media stop the malware from being introduced at all. Detection, restoration, and backup-frequency changes act after or around the event and do not stop the initial execution on the host.

Question 30Cybersecurity Foundations and Threat Landscape

A threat intelligence report states that a criminal group is financially motivated, reuses commodity ransomware, and targets healthcare providers because of their low tolerance for downtime. Which element of the threat landscape does this description primarily characterize?

  1. The organization's own vulnerability severity ratings
  2. The effectiveness of a specific firewall rule set
  3. The threat actor's motivation, capability, and targeting pattern Correct answer.
  4. The encryption strength of the ransomware payload

Explanation

Threat actor profiles combine motivation, capability, and targeting preferences, which together inform likelihood and help defenders prioritize sectors and assets. Vulnerability ratings, firewall rule effectiveness, and cryptographic strength describe defensive posture or malware mechanics rather than the actor's intent and targeting behavior.

Question 31Network Security and Perimeter Defense

A security analyst is placing a firewall between the internet and a DMZ that hosts public web servers. Which firewall placement best enforces the principle of least exposure while still allowing inbound HTTP and HTTPS?

  1. Place the firewall inline between the internet edge and the DMZ, permitting only ports 80 and 443 inbound Correct answer.
  2. Attach the DMZ servers directly to the internet router and rely on host firewalls only
  3. Deploy the firewall on the internal LAN only and allow all DMZ traffic to reach it unrestricted
  4. Place the firewall only behind the DMZ so internal traffic is filtered but inbound traffic is unfiltered

Explanation

A perimeter firewall must sit inline on the traffic path so it can inspect and filter packets before they reach protected hosts. Allowing only TCP 80 and 443 inbound to the DMZ satisfies the business requirement while minimizing exposed services. Host firewalls are useful defense in depth but do not replace an inline perimeter control.

Question 32Network Security and Perimeter Defense

Which statement correctly distinguishes a stateful firewall from a stateless packet filter?

  1. A stateful firewall operates only at the application layer, while a stateless filter operates only at the data link layer
  2. A stateless packet filter can reassemble application payloads, while a stateful firewall cannot inspect headers
  3. A stateful firewall maintains a session table so return traffic for an established connection can be permitted without an explicit inbound rule Correct answer.
  4. A stateful firewall evaluates each packet in isolation against static ACLs, while a stateless filter tracks connection state

Explanation

Stateful inspection records connection state in a session table, so replies belonging to an outbound-initiated session are allowed automatically. Stateless filters examine each packet independently and require explicit rules for both directions. This state tracking is the core functional difference at the network and transport layers.

Question 33Network Security and Perimeter Defense

An organization wants to segment its data center so that only the database tier can accept connections from the application tier on port 5432. Which control most directly implements this requirement?

  1. A DNS zone transfer restriction on the database servers
  2. A VLAN trunk carrying all tiers on one broadcast domain
  3. A network ACL or security group rule permitting TCP 5432 from the application subnet to the database subnet only Correct answer.
  4. A web application firewall placed in front of the application tier

Explanation

Microsegmentation between tiers is enforced with ACLs or security group rules that restrict source, destination, and port. Permitting only TCP 5432 from the application subnet to the database subnet implements least privilege at the network layer. Other controls do not restrict tier-to-tier database connections.

Question 34Network Security and Perimeter Defense

A company wants to prevent employees from reaching known malicious domains while allowing legitimate SaaS traffic. Which perimeter control is most appropriate for this goal?

  1. A DNS filtering service that blocks resolution of domains on threat intelligence blocklists Correct answer.
  2. A reverse proxy that terminates inbound TLS for public web servers
  3. A stateless packet filter blocking all outbound UDP port 53 traffic
  4. An intrusion prevention system configured only to alert on signatures

Explanation

DNS filtering blocks name resolution for known malicious domains before a connection is established, which matches the requirement while leaving legitimate SaaS domains reachable. It is a common perimeter and endpoint control against command-and-control and phishing infrastructure. Blocking all DNS would break legitimate resolution.

Question 35Network Security and Perimeter Defense

Which characteristic is the primary advantage of a next-generation firewall over a traditional port-based firewall?

  1. It can identify and control applications regardless of the port they use, and apply user-aware policy Correct answer.
  2. It encrypts all traffic passing through it with a site-to-site tunnel
  3. It replaces the need for endpoint antivirus software entirely
  4. It eliminates the need for any routing configuration on the perimeter

Explanation

NGFWs perform application identification and can enforce policy based on the application and user identity rather than only IP and port. This defeats evasion techniques such as tunneling applications over allowed ports. They complement, rather than replace, routing, encryption, and endpoint controls.

Question 36Network Security and Perimeter Defense

An analyst reviewing firewall logs sees many inbound connection attempts to TCP 3389 from diverse external addresses. What is the most appropriate immediate interpretation and response?

  1. The traffic should be allowed because RDP encrypts its sessions
  2. This is normal web traffic and requires no action
  3. The attempts prove a successful compromise of the RDP service
  4. Internet-exposed RDP is being probed for brute-force or exploitation; restrict 3389 to trusted sources or remove the exposure Correct answer.

Explanation

Repeated inbound attempts to TCP 3389 from many external sources indicate internet-wide scanning and brute-force probing of Remote Desktop. The correct response is to remove or restrict the exposure, for example via VPN or allowlisted source addresses. Encryption of RDP does not prevent credential attacks.

Question 37Network Security and Perimeter Defense

Which protocol and port combination is used by a site-to-site IPsec VPN for IKEv2 key exchange over UDP?

  1. UDP 123
  2. TCP 25
  3. UDP 500 Correct answer.
  4. TCP 443

Explanation

IKE, the key exchange protocol for IPsec, uses UDP port 500 for initial negotiations. NAT traversal extends this with UDP 4500 when NAT devices are present. Port 443 is HTTPS, 123 is NTP, and 25 is SMTP.

Question 38Network Security and Perimeter Defense

A remote worker needs secure access to internal applications without exposing them directly to the internet. Which approach best reflects a zero-trust remote access model?

  1. Use a VPN concentrator with split tunneling disabled and enforce device posture checks before granting access Correct answer.
  2. Allow direct RDP from the internet protected only by a long password
  3. Rely on NAT to hide internal hosts and assume they are unreachable
  4. Publish each internal application on a public IP with a host firewall exception

Explanation

Zero-trust remote access verifies identity and device posture before granting least-privilege access, typically through a VPN or zero-trust network access broker. Full-tunnel VPN with posture checks keeps internal applications off the public internet. NAT alone is not an access control.

Question 39Network Security and Perimeter Defense

Which IDS/IPS deployment mode allows an appliance to block malicious traffic inline while still passing legitimate traffic?

  1. NetFlow-only collection
  2. Inline prevention mode Correct answer.
  3. Passive SPAN monitoring
  4. TAP-based capture

Explanation

Inline prevention mode places the sensor directly in the traffic path so it can drop malicious packets in real time. Passive SPAN, TAP, and flow-only collection observe traffic but cannot block it. Only inline deployment provides active prevention.

Question 40Network Security and Perimeter Defense

An IPS signature fires on legitimate business traffic during month-end processing, disrupting operations. Which tuning approach is most appropriate?

  1. Create a suppression or exception rule scoped to the specific signature, source, and destination involved Correct answer.
  2. Delete all signatures in the same category
  3. Convert the IPS to passive mode permanently
  4. Disable the entire IPS globally to prevent further disruption

Explanation

False positives should be tuned narrowly by suppressing or excepting the specific signature for the known legitimate source, destination, and context. This preserves detection coverage for genuine attacks. Disabling the IPS or broad categories removes protection unnecessarily.

Question 41Network Security and Perimeter Defense

Which statement best describes the role of a DMZ in perimeter defense?

  1. It is a wireless network reserved for guest devices
  2. It is the internal VLAN where domain controllers are placed
  3. It is a subnet that holds internet-facing services isolated from the internal network by additional filtering Correct answer.
  4. It is a backup network used only during disaster recovery

Explanation

A DMZ is a segmented network for externally reachable services, separated from the internal LAN by firewalls so a compromised public server does not grant direct internal access. Traffic between the DMZ and internal network is tightly restricted. This containment is the defining purpose of a DMZ.

Question 42Network Security and Perimeter Defense

A web application firewall is deployed in front of an e-commerce site. Which attack does it most directly mitigate?

  1. DHCP starvation on the access switch
  2. ARP spoofing on the local VLAN
  3. BGP route hijacking at the ISP
  4. SQL injection in HTTP request parameters Correct answer.

Explanation

A WAF inspects HTTP and HTTPS requests and can block application-layer attacks such as SQL injection and cross-site scripting. It does not address layer 2 attacks like ARP spoofing or DHCP starvation, nor wide-area routing attacks like BGP hijacking. Those require different controls.

Question 43Network Security and Perimeter Defense

An analyst must choose a control that detects port scanning across the perimeter before exploitation occurs. Which control is most directly suited?

  1. File integrity monitoring on the web server
  2. Network intrusion detection with scan-detection signatures and flow analysis Correct answer.
  3. Email content filtering
  4. Disk encryption on employee laptops

Explanation

Port scanning is reconnaissance visible in network traffic, so network IDS signatures and flow analysis are suited to detecting it early. File integrity monitoring, disk encryption, and email filtering address different threat vectors. Early detection of scanning supports blocking the source before exploitation.

Question 44Network Security and Perimeter Defense

Which practice best protects against brute-force attacks on an internet-facing SSH service?

  1. Move SSH to a nonstandard port and consider the service secured
  2. Disable password authentication in favor of key-based authentication and restrict source addresses Correct answer.
  3. Enable root login to simplify administration
  4. Allow password authentication for all users and increase the idle timeout

Explanation

Key-based authentication removes the password-guessing vector, and source restriction limits who can attempt connections at all. Changing the port alone is security through obscurity and does not stop determined attackers. Root login increases impact if credentials are compromised.

Question 45Network Security and Perimeter Defense

A security team wants to detect command-and-control traffic that uses DNS tunneling. Which monitoring approach is most effective?

  1. Auditing local administrator group membership
  2. Reviewing firewall rules for unused port 80 entries
  3. Counting total bytes transferred per user each month
  4. Analyzing DNS query volume, entropy of queried names, and unusually long subdomains Correct answer.

Explanation

DNS tunneling hides data in encoded subdomains, producing high-entropy, unusually long query names and abnormal query volumes to a single domain. Analyzing these characteristics detects tunneling that simple volume metrics miss. The other options do not examine DNS content.

Question 46Network Security and Perimeter Defense

Which perimeter architecture best limits lateral movement if a public-facing web server is compromised?

  1. A single firewall rule permitting any internal host to reach any other host
  2. Placing all servers behind one NAT gateway with no internal filtering
  3. A segmented design with separate DMZ, application, and database zones and deny-by-default inter-zone rules Correct answer.
  4. A flat network where web, application, and database servers share one VLAN

Explanation

Segmentation with deny-by-default inter-zone rules confines an attacker to the compromised zone and forces additional controls to be bypassed for lateral movement. Flat networks and any-any rules allow unrestricted pivoting. NAT does not provide internal segmentation.

Question 47Network Security and Perimeter Defense

An organization must allow inbound HTTPS to a public site while hiding backend server addresses. Which control accomplishes both goals?

  1. A stateful firewall permitting all inbound ports
  2. A reverse proxy terminating TLS and forwarding requests to backend servers Correct answer.
  3. A load balancer configured in passthrough mode with public backend IPs
  4. A forward proxy configured for employee browsers

Explanation

A reverse proxy accepts client connections on behalf of backend servers, terminating TLS and forwarding requests, so backend addresses are never exposed to clients. A forward proxy serves outbound client requests instead. Permitting all inbound ports violates least privilege.

Question 48Network Security and Perimeter Defense

Which statement about TLS inspection on a perimeter firewall is accurate?

  1. TLS inspection decrypts traffic, so it should be scoped with privacy, legal, and performance considerations Correct answer.
  2. TLS inspection requires disabling all certificate validation on endpoints
  3. TLS inspection is impossible because TLS traffic cannot be decrypted by any intermediary
  4. TLS inspection only works for unencrypted HTTP traffic

Explanation

TLS inspection re-signs traffic with an internal CA so the firewall can examine payloads, which raises privacy, legal, and performance concerns that require scoping and policy. It is technically feasible but not universal or free of side effects. It does not apply to plaintext HTTP, which needs no decryption.

Question 49Network Security and Perimeter Defense

Which network control most directly mitigates ARP spoofing on a switched campus network?

  1. Spanning Tree Protocol root guard
  2. Dynamic ARP Inspection with DHCP snooping bindings Correct answer.
  3. Port mirroring to an IDS
  4. QoS marking of voice traffic

Explanation

Dynamic ARP Inspection validates ARP packets against trusted DHCP snooping bindings, dropping spoofed replies that attempt to poison ARP caches. Root guard and port mirroring address different concerns. QoS affects traffic handling, not ARP integrity.

Question 50Network Security and Perimeter Defense

A company wants to verify that its perimeter firewall rules follow least privilege. Which activity best accomplishes this?

  1. Disabling logging to reduce storage costs
  2. Reviewing the rule base periodically to remove shadowed, unused, and overly broad rules Correct answer.
  3. Increasing the number of rules to cover every possible port
  4. Allowing any-any at the bottom of the rule base as a safety net

Explanation

Rule base review identifies shadowed, redundant, unused, and overly permissive rules and aligns the configuration with least privilege. Adding rules indiscriminately or permitting any-any at the end defeats the purpose. Logging should be retained to support monitoring and audit.