Implement Secure Access Technologies 100-160 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company is deploying a firewall to protect its internal network. The security team needs to allow remote employees to use IPsec VPN to access internal resources. The firewall must also block all inbound traffic from the internet except for VPN traffic. Which firewall configuration should be used?

   • AAllow inbound UDP 500, UDP 4500, and ESP (IP protocol 50); deny all other inbound traffic
   • BAllow inbound IP protocol 50 only; deny all other inbound traffic
   • CAllow inbound TCP 443; deny all other inbound traffic
   • DAllow inbound TCP 500 and UDP 500; deny all other inbound traffic
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A network administrator needs to prevent internal users from reaching a known malicious website at IP 203.0.113.50. The firewall does not support URL filtering. Which configuration should be used on the firewall to block this traffic?

   • AAn ACL that denies traffic from the internal network to any IP address on port 80
   • BA stateful firewall rule that blocks all UDP traffic to port 53
   • CAn outbound ACL on the internal interface that denies traffic to destination IP 203.0.113.50 and permits all other traffic
   • DAn inbound ACL on the external interface that denies traffic from source IP 203.0.113.50
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which type of firewall inspects the contents of application-layer traffic, such as HTTP requests, to enforce security policies?

   • APacket filtering firewall
   • BStateful firewall
   • CApplication-layer firewall
   • DNetwork address translation (NAT) firewall
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A university wants to allow students to connect their personal devices to the campus network, but only if the devices have a firewall enabled and are free of known malware. The network team wants to automatically isolate non-compliant devices to a restricted network where they can only access the internet, not internal systems. Which combination of technologies best achieves this?

   • AAn ACL that permits only the IP addresses of compliant devices.
   • BA VPN that encrypts all traffic from personal devices.
   • CA stateful firewall that blocks all traffic from personal devices.
   • DNAC with a quarantine VLAN for non-compliant devices.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small company uses a single firewall to segment its network into a public web-server zone and an internal user zone. The firewall currently permits all outbound traffic from the internal zone. Management wants to block internal users from reaching a known malicious file-sharing site while still allowing all other web traffic. Which configuration best meets this requirement with the least administrative overhead?

   • AReplace the firewall with an application-layer gateway that inspects every HTTPS request for the site's domain name.
   • BCreate a packet-filtering rule that denies inbound traffic from the malicious site's IP address.
   • CAdd a stateful firewall rule that denies outbound traffic to the malicious site's IP address and port 443.
   • DConfigure an ACL on the internal router that denies all traffic from the internal subnet to any destination.
   Reveal Solution Discussion Select an answer first