Back to Network Monitoring

Network Security Monitoring

5 minutes 5 Questions

Network security monitoring is the practice of continuously monitoring a network to protect, detect, and respond to potential security threats or incidents. Employing various tools and techniques such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), and Security Information…

Test mode:
Start practice test
CompTIA Network+ - Network Security Monitoring Example Questions

Test your knowledge of Network Security Monitoring

Question 1

You receive an alert from your Intrusion Prevention System (IPS) indicating that an attack is taking place. What should be your immediate course of action?

Correct Answer: Investigate and determine the ongoing attack's nature and severity

Upon receiving an alert from your Intrusion Prevention System (IPS) indicating an ongoing attack, the best immediate course of action would be to 'Investigate and determine the ongoing attack's nature and severity'. This is because understanding the nature and scope of the attack will help to make an informed decision on the necessary actions to mitigate the attack. Disconnecting all user devices from the network or shutting down the entire network could unnecessarily disrupt operations or even aggravate the situation depending on the type of threat. Also, restoring the network from a backup isn't the correct immediate response, as you need to first understand and halt the intrusion before considering restoration actions to ensure that the threat has been thoroughly eliminated.

Question 2

A network administrator suspects that there is unauthorized access to company resources. What network monitoring tool is most appropriate to identify this?

Correct Answer: Intrusion Detection System (IDS)

The best network monitoring tool for identifying unauthorized access to company resources would be the 'Intrusion Detection System (IDS)'. This tool is specifically designed to recognize suspicious activity on a network which could indicate a breach or unauthorized access. It uses predefined rules to detect anomalies and intrusions in network traffic. 'Syslog' is a standard for message logging and while it can record a wide range of system events, it is not specifically purposed for detecting unauthorized access. 'DHCP logs' record events related to the Dynamic Host Configuration Protocol, primarily dealing with IP address assignments. They are not intended to monitor unauthorized access. A 'Network Bandwidth Analyzer' monitors the amount of data transmitted over a network but it doesn’t specifically identify unauthorized access to the system resources.

Question 3

A company has noticed an increased amount of DDoS attacks targeted at their servers. What action should the network administrator take to mitigate these attacks?

Correct Answer: Setup a cloud-based DDoS mitigation service

To mitigate DDoS attacks, the best course of action would be to 'Setup a cloud-based DDoS mitigation service'. These services can absorb the traffic sent during a DDoS attack and prevent it from reaching the server. 'Disabling network monitoring' is incorrect because it would limit visibility into the network and make it even more difficult to respond to DDoS attacks. 'Lowering firewall security settings' would make the server more vulnerable to attack rather than less, hence it is not the correct answer 'Removing intrusion prevention systems' is incorrect as it would make the server even more vulnerable to all types of attacks, not just DDoS.

More Network Security Monitoring questions
10 questions (total)
Start 10 question test