5.4 Describe the Components of Network Security Design 350-401 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which component of a threat defense architecture is responsible for taking action to block or mitigate a detected threat?

   • ASecurity information and event management (SIEM)
   • BIntrusion prevention system (IPS)
   • CVulnerability scanner
   • DIntrusion detection system (IDS)
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is deploying NGFWs in a high-availability pair at the internet edge. The NGFWs must perform SSL/TLS inspection on all outbound traffic. The security team is concerned about performance degradation and certificate management. Which design decision best addresses these concerns?

   • AConfigure the NGFW to bypass inspection for all encrypted traffic
   • BUse a single NGFW with higher throughput to handle all inspection
   • CDisable SSL/TLS inspection for traffic to trusted financial sites
   • DDeploy dedicated SSL/TLS inspection hardware or use a separate inspection zone to offload decryption
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A university has deployed an endpoint detection and response (EDR) agent on all faculty laptops. The network team wants to automatically quarantine a laptop from the network if the EDR agent detects a high-severity threat. The quarantine must be enforced at the network access layer, not just on the endpoint. Which integration approach should be used?

   • ADeploy a separate IPS in front of the faculty VLAN and configure it to block traffic from the laptop's IP address after receiving an alert.
   • BConfigure the EDR agent to block all network traffic locally on the laptop when a threat is detected.
   • CUse the EDR agent to send syslog messages to the firewall, which then manually updates ACLs.
   • DIntegrate the EDR console with the NAC solution using an API so that when a threat is detected, the NAC can change the endpoint's access policy or VLAN.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a common deployment scenario for MACsec?

   • ABetween a web server and a client over the internet
   • BBetween a user's laptop and a wireless access point
   • CBetween two switches in a data center
   • DBetween a router and an ISP over a DSL line
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the purpose of SSL/TLS inspection on an NGFW?

   • ATo provide a secure tunnel for remote users
   • BTo encrypt all traffic passing through the firewall
   • CTo block all SSL/TLS traffic
   • DTo decrypt and inspect encrypted traffic for threats
   Reveal Solution Discussion Select an answer first