3.7 Security Features to Comply with Organizational Security Policies, Procedures, and Standards BCP 38 CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A large enterprise has multiple internet connections from different ISPs for redundancy. The network uses BGP to advertise its public prefixes. The security team is implementing BCP 38 ingress filtering on all edge routers. The network also uses a public IP range that is not yet fully utilized, and some internal servers use RFC 1918 addresses with NAT. The team must ensure that ingress filtering does not break legitimate traffic. Which approach best balances BCP 38 compliance with operational continuity?

   • ADisable ingress filtering on the backup ISP link to avoid breaking traffic during failover
   • BUse a single ACL that permits all RFC 1918 addresses and denies all public addresses
   • CApply inbound ACLs on each edge router that permit only the enterprise's advertised public prefixes and the NAT pool, and deny all other source addresses
   • DApply outbound ACLs on each edge router that permit only the enterprise's public prefixes
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A financial institution is undergoing a PCI-DSS assessment. The network includes a legacy application that transmits cardholder data in clear text over the internal network. The application cannot be modified to use TLS. The assessor has flagged this as a finding. The security team must implement a compensating control to meet PCI-DSS Requirement 4.1 (encrypt transmission of cardholder data across open, public networks). Which compensating control is most appropriate?

   • AImplement strong authentication for the application, but leave the data unencrypted
   • BUse a firewall rule to restrict access to the application to only authorized users, but allow clear text transmission
   • CPlace a network-level encryption device (e.g., IPsec VPN) between the application client and server to encrypt all traffic in transit
   • DDisable the application's network access and only allow local access
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A multinational company is implementing ISO 27001 and has a distributed network with regional offices connected via MPLS. The company wants to implement network segregation between the corporate network and the guest Wi-Fi network. The guest network is used by visitors and is considered untrusted. Which approach best meets ISO 27001 Annex A.13.1.3 while maintaining usability for guests?

   • ADeploy a separate VLAN for guest Wi-Fi with a firewall that restricts guest traffic to internet access only, and block access to the corporate network
   • BAllow guest traffic to access only the corporate file server to enable collaboration
   • CUse a firewall that allows guest traffic to access the corporate network but logs all activity
   • DPlace guest Wi-Fi on the same VLAN as the corporate network for simplicity and ease of management
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A network administrator is troubleshooting a BCP 38 ingress filtering issue. The edge router has an inbound ACL that permits only the internal public IP range 198.51.100.0/24. However, users are reporting that they cannot access external websites. The administrator discovers that the internal network uses NAT, and the NAT pool is 203.0.113.10-203.0.113.20. What is the most likely cause of the issue?

   • AThe ACL is too permissive and is allowing spoofed traffic, causing routing loops
   • BThe ACL does not permit the NAT pool addresses, so return traffic from the internet is being dropped
   • CThe ACL is blocking all traffic because the internal network uses RFC 1918 addresses, which are not in the permitted range
   • DThe ACL is applied outbound instead of inbound, so it is filtering outgoing traffic and blocking legitimate outbound connections
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A payment processor is preparing for a PCI-DSS audit. The network includes a wireless network used by employees to access the cardholder data environment (CDE). The wireless network uses WPA2-PSK with a shared passphrase. The assessor has identified this as a finding. Which change is most aligned with PCI-DSS Requirement 4.1.1 (use strong cryptography for wireless transmissions) and Requirement 8.2.1 (unique user IDs)?

   • AUse WPA2-PSK with a longer passphrase to increase security
   • BReplace WPA2-PSK with WPA2-Enterprise using 802.1X authentication with individual user credentials
   • CKeep WPA2-PSK but change the passphrase monthly
   • DDisable wireless access to the CDE and require employees to use wired connections only
   Reveal Solution Discussion Select an answer first