Advanced Network Defence Masterclass Practice Test 2026 | Ex

During a threat hunting exercise, you identify a persistent beacon using DNS over HTTPS (DoH) to a known malicious domain. The C2 server's IP address is actively changing. What is the most effective containment strategy that also preserves forensic evidence?

When implementing a Zero Trust architecture, which principle is most critical for enforcing micro-segmentation at the network layer to limit lateral movement?

An analyst is reviewing a Suricata alert for a potential SQL injection attack. The payload is heavily obfuscated with URL encoding. Which Suricata feature would be most effective for reliably detecting this type of attack without generating excessive false positives?