A company is choosing a firewall for its network perimeter. The security team needs to block malware that uses dynamic ports and also needs to allow legitimate VoIP traffic that uses a range of UDP ports. Which firewall type is best suited for this requirement?

A network address translation (NAT) firewall that hides internal IP addresses.

A packet-filtering firewall that allows all UDP traffic.

A stateful firewall that tracks connection state and can allow return traffic for VoIP.

An application-layer firewall that inspects all VoIP traffic and blocks all other UDP.

A company wants to allow its employees to access internal resources from home while ensuring that the traffic is protected from eavesdropping. The company already has a firewall at the network perimeter. Which additional technology should be implemented to provide secure remote access?

A demilitarized zone (DMZ) for the internal resources.

An intrusion prevention system (IPS) placed in front of the firewall.

A VPN concentrator that terminates IPsec or SSL/TLS tunnels.

A network access control (NAC) system that checks endpoint compliance.

A company wants to prevent unauthorized devices from connecting to its wired network. The network team has decided to use NAC with 802.1X authentication. Which additional configuration is required to ensure that only authorized devices can access the network?

Deploy a firewall between the switch and the rest of the network.

Enable DHCP snooping on the switch.

Use an ACL to block all traffic from unknown MAC addresses.

Configure the switch ports to use 802.1X and define a policy that grants access only to devices that authenticate successfully.

What is the primary purpose of Network Access Control (NAC)?

To provide load balancing across multiple internet connections

To enforce endpoint compliance and control network access based on policy

To monitor network traffic for intrusion attempts

To encrypt all network traffic between switches and routers

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 2Objective 5

Implement Secure Access Technologies 100-160 Practice Questions (Page 3)

Part of the Basic Network Security Concepts domain, which makes up ~19% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

4concepts

Questions 11–15

11expert · hard
A company is choosing a firewall for its network perimeter. The security team needs to block malware that uses dynamic ports and also needs to allow legitimate VoIP traffic that uses a range of UDP ports. Which firewall type is best suited for this requirement?
Select an answer first
12application · medium
A company wants to allow its employees to access internal resources from home while ensuring that the traffic is protected from eavesdropping. The company already has a firewall at the network perimeter. Which additional technology should be implemented to provide secure remote access?
Select an answer first
13application · medium
A company is setting up remote access for employees who work from home. The security team requires that all remote connections be encrypted and that only company-issued laptops with the latest antivirus definitions can connect. Which two technologies should be used together to meet these requirements?
Select an answer first
14application · medium
A company wants to prevent unauthorized devices from connecting to its wired network. The network team has decided to use NAC with 802.1X authentication. Which additional configuration is required to ensure that only authorized devices can access the network?
Select an answer first
15foundation · easy
What is the primary purpose of Network Access Control (NAC)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.