{{asɛmtiNe Ɔkyerɛwfo}} | Nhomakorabea | Nneɛma a ɛma wotumi yɛ ade

1

Which of the following best describes the primary purpose of network segmentation?

Dividing a network into smaller, isolated subnets to isolate traffic.

Combining multiple networks into a single, larger broadcast domain.

Increasing the speed of data transfer between all devices on the network.

Encrypting all traffic moving between internal and external networks.

1

What is a "screened subnet" (or DMZ) typically used for?

It is a high-security zone strictly for internal employee databases.

It is a network segment located between the public internet and the internal private network, usually hosting public-facing resources.

It is a subnet used exclusively for wireless administrative access.

It is a physical room where all network switches are stored.

1

If a message needs to travel from one VLAN to a different VLAN, what type of device must it pass through?

A Layer 2 switch

A Layer 3 or routing-capable device

A passive hub

A wireless access point

1

How does port security on a switch specifically help prevent MAC flooding?

By routing all traffic to a screened subnet for analysis.

By encrypting the MAC addresses of all connected devices.

By limiting the number of MAC addresses that can be assigned to a single switch port.

By automatically turning off the switch if it overheats.

1

What is the key difference between a Network Intrusion Detection System (NIDS) and a Network Intrusion Prevention System (NIPS)?

A NIPS can actively mitigate or halt an attack (e.g., closing ports), whereas a NIDS only analyzes and alerts.

A NIDS is used for external networks, while a NIPS is used for internal networks.

There is no functional difference; they are different names for the same tool.

A NIDS analyzes data, while a NIPS only collects logs without analysis.

1

Which tool is responsible for collecting data streams from multiple sources (firewalls, logs, NIDS) to detect patterns indicating a cyberattack?

Packet Sniffer

Signature Database

Security Incident and Event Management (SIEM) system

Switch Port Analyzer

1

Which of the following is a characteristic of signature-based detection?

It requires powerful dedicated servers to create a statistical baseline.

It can quickly process potential IoCs with a low rate of false positives.

It has a high rate of false positives.

It is the best method for detecting brand new, zero-day attacks.

1

What is a significant risk associated with establishing a baseline for anomaly-based detection?

It completely replaces the need for any manual log review.

It guarantees that zero-day attacks will be detected.

The baseline database is too small to store on modern hard drives.

The device or network might already be compromised when the baseline is created, making attack behavior appear normal.

1

Why might an organization hesitate to implement a hybrid detection model despite its effectiveness?

It generates fewer alerts, which might make security teams complacent.

It cannot detect known attacks, only novel ones.

It relies solely on human analysis rather than automated tools.

It is significantly more expensive and resource-intensive than using a single method.

1

What phenomenon occurs when detection systems generate so many false positives that security personnel become desensitized to them?

Baseline drift

Denial of Service

Signature saturation

Alert fatigue

1

Which of the following methods would be most effective for detecting an evil-twin attack?

Monitoring for a drop in website traffic.

Checking the ARP table on the default gateway.

Analyzing the log files of the internal firewall.

Regularly scanning for SSIDs that look suspicious or similar to legitimate local SSIDs.

1

If you notice that no wireless devices in a specific physical space are able to connect to the network, and you scan for electromagnetic noise, what attack are you likely investigating?

ARP Poisoning

Jamming

MAC Flooding

DNS Poisoning

1

A security analyst notices an unexpected surge of ethernet frames with different MAC addresses. Which attack is likely occurring?

MAC Poisoning

MAC Flooding

DNS Poisoning

SQL Injection

1

Which of the following indicators might suggest a DNS poisoning attack?

Multiple failed login attempts on the firewall.

An abrupt and otherwise inexplicable drop in traffic to the organization's website.

Duplicate MAC address entries in the ARP table.

High electromagnetic noise in the wireless frequency range.

1

Why are AI algorithms increasingly necessary for threat detection in modern networks?

Because standard logs do not record IP addresses.

Because human teams are incapable of analyzing the millions of data points logged daily by medium-to-large networks.

Because AI removes the need for any human security analysts.

Because AI is cheaper than standard firewall software.

1

When configuring AI threat detection, what is the danger of setting the alert threshold too low?

The security team will be overwhelmed with false alerts.

The AI will become self aware and attack your network

Real attacks will go undetected.

The AI will stop collecting data entirely.

4

A company with a small IT team has to choose between using a signature-based detection method and an anomaly-based detection method.
Which one would you recommend they use? Explain how your choice works and why it would work for them. (4 points)

AP Cybersecurity: Topic 3.4 & 3.5 Quiz

AP Cybersecurity: Topic 3.4 & 3.5 Quiz

Which of the following best describes the primary purpose of network segmentation?

What is a "screened subnet" (or DMZ) typically used for?

If a message needs to travel from one VLAN to a different VLAN, what type of device must it pass through?

How does port security on a switch specifically help prevent MAC flooding?

What is the key difference between a Network Intrusion Detection System (NIDS) and a Network Intrusion Prevention System (NIPS)?

Which tool is responsible for collecting data streams from multiple sources (firewalls, logs, NIDS) to detect patterns indicating a cyberattack?

Which of the following is a characteristic of signature-based detection?

What is a significant risk associated with establishing a baseline for anomaly-based detection?

Why might an organization hesitate to implement a hybrid detection model despite its effectiveness?

What phenomenon occurs when detection systems generate so many false positives that security personnel become desensitized to them?

Which of the following methods would be most effective for detecting an evil-twin attack?

If you notice that no wireless devices in a specific physical space are able to connect to the network, and you scan for electromagnetic noise, what attack are you likely investigating?

A security analyst notices an unexpected surge of ethernet frames with different MAC addresses. Which attack is likely occurring?

Which of the following indicators might suggest a DNS poisoning attack?

Why are AI algorithms increasingly necessary for threat detection in modern networks?

When configuring AI threat detection, what is the danger of setting the alert threshold too low?

A company with a small IT team has to choose between using a signature-based detection method and an anomaly-based detection method.
Which one would you recommend they use? Explain how your choice works and why it would work for them. (4 points)

Which of the following best describes the primary purpose of network segmentation?

What is a "screened subnet" (or DMZ) typically used for?

If a message needs to travel from one VLAN to a different VLAN, what type of device must it pass through?

How does port security on a switch specifically help prevent MAC flooding?

What is the key difference between a Network Intrusion Detection System (NIDS) and a Network Intrusion Prevention System (NIPS)?

Which tool is responsible for collecting data streams from multiple sources (firewalls, logs, NIDS) to detect patterns indicating a cyberattack?

Which of the following is a characteristic of signature-based detection?

What is a significant risk associated with establishing a baseline for anomaly-based detection?

Why might an organization hesitate to implement a hybrid detection model despite its effectiveness?

What phenomenon occurs when detection systems generate so many false positives that security personnel become desensitized to them?

Which of the following methods would be most effective for detecting an evil-twin attack?

If you notice that no wireless devices in a specific physical space are able to connect to the network, and you scan for electromagnetic noise, what attack are you likely investigating?

A security analyst notices an unexpected surge of ethernet frames with different MAC addresses. Which attack is likely occurring?

Which of the following indicators might suggest a DNS poisoning attack?

Why are AI algorithms increasingly necessary for threat detection in modern networks?

When configuring AI threat detection, what is the danger of setting the alert threshold too low?

A company with a small IT team has to choose between using a signature-based detection method and an anomaly-based detection method.
Which one would you recommend they use? Explain how your choice works and why it would work for them. (4 points)

AP Cybersecurity: Topic 3.4 & 3.5 Quiz

AP Cybersecurity: Topic 3.4 & 3.5 Quiz

Which of the following best describes the primary purpose of network segmentation?

What is a "screened subnet" (or DMZ) typically used for?

If a message needs to travel from one VLAN to a different VLAN, what type of device must it pass through?

How does port security on a switch specifically help prevent MAC flooding?

What is the key difference between a Network Intrusion Detection System (NIDS) and a Network Intrusion Prevention System (NIPS)?

Which tool is responsible for collecting data streams from multiple sources (firewalls, logs, NIDS) to detect patterns indicating a cyberattack?

Which of the following is a characteristic of signature-based detection?

What is a significant risk associated with establishing a baseline for anomaly-based detection?

Why might an organization hesitate to implement a hybrid detection model despite its effectiveness?

What phenomenon occurs when detection systems generate so many false positives that security personnel become desensitized to them?

Which of the following methods would be most effective for detecting an evil-twin attack?

If you notice that no wireless devices in a specific physical space are able to connect to the network, and you scan for electromagnetic noise, what attack are you likely investigating?

A security analyst notices an unexpected surge of ethernet frames with different MAC addresses. Which attack is likely occurring?

Which of the following indicators might suggest a DNS poisoning attack?

Why are AI algorithms increasingly necessary for threat detection in modern networks?

When configuring AI threat detection, what is the danger of setting the alert threshold too low?

A company with a small IT team has to choose between using a signature-based detection method and an anomaly-based detection method.Which one would you recommend they use? Explain how your choice works and why it would work for them. (4 points)

Which of the following best describes the primary purpose of network segmentation?

What is a "screened subnet" (or DMZ) typically used for?

If a message needs to travel from one VLAN to a different VLAN, what type of device must it pass through?

How does port security on a switch specifically help prevent MAC flooding?

What is the key difference between a Network Intrusion Detection System (NIDS) and a Network Intrusion Prevention System (NIPS)?

Which tool is responsible for collecting data streams from multiple sources (firewalls, logs, NIDS) to detect patterns indicating a cyberattack?

Which of the following is a characteristic of signature-based detection?

What is a significant risk associated with establishing a baseline for anomaly-based detection?

Why might an organization hesitate to implement a hybrid detection model despite its effectiveness?

What phenomenon occurs when detection systems generate so many false positives that security personnel become desensitized to them?

Which of the following methods would be most effective for detecting an evil-twin attack?

If you notice that no wireless devices in a specific physical space are able to connect to the network, and you scan for electromagnetic noise, what attack are you likely investigating?

A security analyst notices an unexpected surge of ethernet frames with different MAC addresses. Which attack is likely occurring?

Which of the following indicators might suggest a DNS poisoning attack?

Why are AI algorithms increasingly necessary for threat detection in modern networks?

When configuring AI threat detection, what is the danger of setting the alert threshold too low?

A company with a small IT team has to choose between using a signature-based detection method and an anomaly-based detection method.Which one would you recommend they use? Explain how your choice works and why it would work for them. (4 points)

A company with a small IT team has to choose between using a signature-based detection method and an anomaly-based detection method.
Which one would you recommend they use? Explain how your choice works and why it would work for them. (4 points)

A company with a small IT team has to choose between using a signature-based detection method and an anomaly-based detection method.
Which one would you recommend they use? Explain how your choice works and why it would work for them. (4 points)