MENU
You are concerned about rootkits on your network communicating with attackers outside your network. Without using an IDS how can you detect this sort of activity?
Suggested Answer: D
Get Premium GSNA Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Firewall logs will show all incoming and outgoing traffic. By examining those logs you can detect anomalous traffic, which can indicate the presence of malicious code such as rootkits.
Answer B is incorrect. While an IDS might be the most obvious solution in this scenario, it is not the only one.
Answer C is incorrect. It is very unlikely that anything in your domain controller logs will show the presence of a rootkit, unless that
rootkit is on the domain controller itself.
Answer A is incorrect. A DMZ is an excellent firewall configuration but will not aid in detecting rootkits.
13 comments · newest first
CA
Casey
11 months ago
Domain controller logs can show suspicious activity too!
LO
Lourdes
11 months ago
Really? Can you actually catch rootkits without an IDS?
ST
Stevie
12 months ago
DMZ won't help with rootkit detection, just saying.
KI
Kimbery
12 months ago
Totally agree, firewall logs are key!
ES
Estrella
12 months ago
You can check firewall logs for unusual traffic.
AL
Alise
1 year ago
I believe checking the domain controller logs could show some signs of compromise, but I’m leaning towards firewall logs being more effective.
KI
King
1 year ago
I’m a bit confused. I thought a DMZ was more about segmentation than detection. Can it really help with rootkits?
DE
Deandrea
1 year ago
I remember discussing how examining logs can help identify unusual patterns, but I'm not sure if it's enough without an IDS.
WI
Winfred
1 year ago
I think we practiced a similar question about using logs to detect anomalies. I feel like firewall logs could be useful here.
TA
Tawny
1 year ago
Ah, I've seen this type of issue before. The key here is to use a network capture tool like Wireshark or Netmon to analyze the traffic. That will give you visibility into what's actually being sent to and from the client, which should help you identify the problem.
SH
Sherita
1 year ago
Okay, let me think this through. We need to insert a comment that says the page validates as HTML5 and who the author is. I'm pretty sure the HTML comment syntax is the right approach, so I'll select option D.
AL
Alex
1 year ago
This seems like a pretty straightforward question about Cisco UCS components. I'll need to remember the key functions of the Cisco Integrated Management Controller and how it relates to the other UCS components.
EL
Elke
1 year ago
I've got this! The key is to look at the network diagram and see where the routers are located. That will help me determine the type of BGP sessions.