5.4 Describe the Components of Network Security Design 350-401 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to enforce a policy that blocks all social media traffic from the corporate network, but allows access to a specific marketing tool that uses the same domain as a social media site. The firewall must be able to distinguish between the two applications. Which feature is required on the next-generation firewall?

   • AURL filtering based on domain name only.
   • BUser identity integration with Active Directory.
   • CSSL/TLS inspection to decrypt traffic and read the application headers.
   • DApplication identification based on application signatures and behavioral analysis, not just port or domain.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What capability of an NGFW allows it to apply policies based on the identity of the user?

   • AMAC address filtering
   • BUser identification
   • CPort-based filtering
   • DIP address filtering
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of network segmentation in a threat defense design?

   • ATo provide a single broadcast domain for all devices
   • BTo limit the lateral movement of attackers within the network
   • CTo increase the speed of network traffic between segments
   • DTo eliminate the need for firewalls in the network
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security architect is designing a threat defense architecture for a large enterprise. The architect wants to ensure that if an attacker compromises one server, the attacker cannot easily move laterally to other servers. The architect also wants to detect and respond to threats in real time. Which combination of controls should be implemented?

   • ANetwork segmentation with internal firewalls, an EDR solution on all endpoints, and a SIEM for centralized monitoring.
   • BA VPN concentrator for remote access and a NAC solution for endpoint compliance.
   • CAn IDS in promiscuous mode on the core network and a host firewall on all servers.
   • DA single next-generation firewall at the internet edge and antivirus on all servers.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is a key difference between a traditional IDS/IPS and a next-generation IPS (NGIPS)?

   • ATraditional IDS/IPS can decrypt SSL/TLS traffic, but NGIPS cannot
   • BNGIPS only works in passive mode, while traditional IPS is inline
   • CNGIPS is only used in data centers, while traditional IPS is used at the edge
   • DNGIPS adds application awareness and intelligence beyond simple signature matching
   Reveal Solution Discussion Select an answer first