Match each description to the class of malicious software it describes.

Note: one option is not used.

A Security Operations Centre receives 12,000

alerts per day from its SIEM.

After a tuning exercise,

How many alerts per day remain for the analysts to triage?

An analyst notices that a workstation is making regular outbound connections to an unfamiliar host

at 03:00 every night, several days after a staff member opened an email attachment. No files have

been encrypted and nothing has yet been stolen.

Which stage of the malware attack lifecycle does this behaviour represent, and what does

blocking it achieve?

The university must (i) join its main campus and a branch campus so that all IP traffic between

them crosses the internet securely as one private network, and (ii) let visiting lecturers reach a

handful of internal web applications from any borrowed computer, with no software installed.

Which pairing is consistent with Lecture 8?

Select ALL statements that are correct according to Lecture 5.

Warning: incorrect selections carry a negative penalty.

Consider the following statement:

"Encrypting all traffic with TLS defends against eavesdropping and man-in-the-middle

interception, but it does not prevent a denial-of-service attack against the server."

Is this statement true or false?

A firewall is configured with exactly these rules, evaluated top-down:

1. Any → Web server, port 443, ALLOW

Consider the following five traffic flows:

(i) Internet host → Web server, port 443

Which flows are permitted?

A network team proposes: "Any device physically plugged into a socket inside our buildings is on

the internal VLAN, so it is trusted and may reach any internal server without further checks.

External users go through the VPN."

Which criticism follows from the zero trust principles in Lecture 8?