2.1 Describe Network Security Solutions and Deployment Models That Provide Intrusion Prevention and Firewall Capabilities 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to automate the response to IPS alerts. For example, when the IPS detects a brute-force attack, they want the firewall to automatically block the source IP. Which integration should they configure?

   • ASIEM integration to display alerts
   • BSyslog forwarding to the firewall
   • COrchestration between IPS and firewall using APIs
   • DManual process where analysts update firewall rules
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A large enterprise is deploying a centralized management platform for its multiple firewalls and IPS devices. The security team wants to ensure that if the management platform fails, the security devices continue to enforce the last known policies. Which design should they implement?

   • AImplement a backup management platform in a different geographic region
   • BDeploy the management platform in high-availability mode with stateful synchronization
   • CUse a cloud-based management platform with automatic failover
   • DConfigure the security devices to operate independently if management is lost
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the purpose of deploying firewalls in an active/standby high-availability pair?

   • ATo provide redundancy so that if the active firewall fails, the standby takes over with minimal disruption.
   • BTo allow one firewall to inspect traffic while the other handles management traffic.
   • CTo provide a backup configuration in case the primary is misconfigured.
   • DTo double the throughput by load-balancing traffic across both devices.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which capability distinguishes a next-generation firewall (NGFW) from a traditional stateful firewall?

   • AThe ability to filter traffic based on source and destination IP addresses.
   • BThe ability to identify and control applications regardless of port or protocol.
   • CThe ability to perform network address translation (NAT) for internal users.
   • DThe ability to track the state of active connections and allow return traffic.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational company is moving its firewall and IPS to a cloud-based solution to reduce on-premises hardware. They have offices in multiple regions and need to ensure low-latency inspection for all locations. Which deployment model should they choose?

   • AHybrid deployment with cloud and on-premises firewalls
   • BCentralized cloud-based firewall in one region
   • CCloud-based firewall with points of presence (PoPs) in each region
   • DOn-premises firewall at each office
   Reveal Solution Discussion Select an answer first