Security Tools -- Quiz

Question 1 of 6

An organization runs a next-generation firewall, an intrusion prevention system, and a vulnerability scanner. All three identify the same vulnerability on a server, but each tool names and describes it differently. Which standard addresses this interoperability problem, and what does it enable?

CIS benchmarks — they define how each tool should configure itself to prevent the vulnerability SCAP — it provides a common language so all tools identify the same vulnerability with the same identifier, enabling cross-tool correlation and automated remediation SIEM — it aggregates the three different findings into one central log and resolves naming conflicts automatically NetFlow — it monitors the traffic associated with the vulnerability and correlates findings from the three tools

Question 2 of 6

A security engineer needs to deploy compliance monitoring across 500 employee laptops and 200 contractor devices. The contractor devices cannot have software installed on them. Which monitoring approach should be used for each device category, and what is the key limitation of the approach used for contractor devices?

Agent-based for all 700 devices; contractor devices can be remotely enrolled without physical access Agentless for employee laptops (real-time monitoring not required); agent-based for contractor devices (temporary installation that removes itself) Agent-based for employee laptops (continuous monitoring and real-time alerts); agentless for contractor devices (key limitation: no continuous monitoring or alerts between check windows) SNMP polling for all devices; both categories respond to the same OID queries over UDP 161

Question 3 of 6

An employee receives a phishing email with a malicious attachment that installs a remote access trojan. The trojan begins sending files containing Social Security numbers to an external server via HTTPS. The organization has DLP deployed only on the email gateway. Which data transfer succeeds and which is blocked?

Both the phishing email attachment and the HTTPS exfiltration are blocked by the email DLP gateway The HTTPS exfiltration is blocked because DLP inspects all HTTPS traffic; the phishing attachment delivery is not prevented The HTTPS exfiltration succeeds because the email DLP only inspects email traffic; a network or endpoint DLP layer would be needed to intercept the HTTPS transfer All DLP systems automatically inspect all network protocols including HTTPS; the exfiltration is blocked regardless of how it is sent

Question 4 of 6

A network management station polls a core router every 10 minutes via SNMP. An interface on that router begins experiencing CRC errors due to a failing cable at 3:00 AM. The interface completely fails at 3:07 AM. At what time would polling alone have first detected the elevated error count, and what mechanism would have provided an earlier alert?

Polling detects it immediately at 3:00 AM; no additional mechanism is needed Polling detects it at 3:10 AM (next poll after 3:00 AM), which is after the interface already failed; an SNMP trap configured on the router to fire when CRC errors exceed a threshold would have alerted at 3:00 AM Polling detects it at 3:00 AM but cannot distinguish between a normal error and a failing cable; an agent installed on the router would provide the differentiation SNMP cannot detect CRC errors; a NetFlow probe would need to be deployed to identify hardware-level errors on the interface

Question 5 of 6

A NetFlow collector reports that a user workstation generated 60 GB of outbound traffic to an unfamiliar external IP address between 11 PM and 4 AM. The workstation's normal daily outbound traffic is under 100 MB. What does this traffic pattern most likely indicate, and what can NetFlow confirm vs. what requires additional investigation?

A scheduled backup job; NetFlow can confirm the backup completed successfully and the data was encrypted in transit Normal software update traffic; large update packages are routinely pushed overnight and NetFlow captures the download metadata A potential data exfiltration; NetFlow confirms the traffic volume, source, destination, and timing anomaly, but content analysis requires additional investigation (endpoint forensics, full packet capture) to determine what was transferred A DDoS attack using the workstation as a bot; NetFlow identifies the attack type and the data that was stolen

Question 6 of 6

A security team runs monthly external vulnerability scans and consistently reports a clean result for the internal server farm, which is firewalled from internet access. A new analyst asks whether internal scans are performed; they are not. An internal scan is then run and finds seven servers with critical CVEs. What explains this discrepancy, and what does it demonstrate about vulnerability scanning scope?

The external scanner has outdated signatures; the same scanner with updated signatures would have found the critical CVEs from outside The internal and external scans use different scoring methodologies; the external scan uses CVSS 2.0 while the internal scan uses CVSS 3.x The firewall blocks external access to those servers, so the external scanner cannot see them; internal scanning reveals vulnerabilities reachable from inside the network that the external scan cannot detect — both scan types are required for complete coverage Internal scans are less accurate than external scans and tend to produce false positives; the seven critical findings should be verified before treating them as real

Matching

Match each description to the correct security tool or standard.

1. A NIST-managed framework that gives diverse security tools a common language for identifying and reporting vulnerabilities, enabling automated cross-tool remediation

2. A security technology that monitors data in motion and at rest to prevent sensitive information (SSNs, medical records, credit cards) from leaving the organization without authorization

3. A network monitoring technology that collects flow statistics using a probe-and-collector architecture to identify top talkers, bandwidth usage, and anomalous traffic patterns

4. A proactive notification mechanism that a monitored device sends to a management station over UDP 162 when a configured threshold is exceeded

1. 2. 3. 4.

A. SCAP

B. DLP

C. NetFlow

D. SNMP Trap

Security Tools — Quiz

Matching