3.7 Security Features to Comply with Organizational Security Policies, Procedures, and Standards BCP 38 CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A network engineer is implementing egress filtering on a corporate firewall. The company has a public IP range 192.0.2.0/24, but also uses a secondary public IP range 198.51.100.0/24 for a specific application. The egress filter must allow both ranges to exit, but block all other source addresses. The engineer is creating an ACL. Which configuration is correct?

   • APermit 192.0.2.0/24 and 198.51.100.0/24, deny all other source addresses, applied outbound on the WAN interface
   • BPermit all source addresses except 192.0.2.0/24 and 198.51.100.0/24, applied outbound on the WAN interface
   • CPermit only 192.0.2.0/24, deny all other source addresses, applied outbound on the WAN interface
   • DPermit 192.0.2.0/24 and 198.51.100.0/24, deny all other source addresses, applied inbound on the WAN interface
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A managed security services provider (MSSP) is hardening its customer edge routers to comply with BCP 38 and PCI-DSS Requirement 1.3.2 (ingress and egress filtering). The customer network uses private RFC 1918 addressing internally. Which egress filtering rule should be applied on the router's WAN interface to prevent spoofed traffic from leaving the network?

   • AApply an inbound ACL on the WAN interface that permits only the customer's public IP range
   • BPermit all source addresses on the outbound direction to avoid breaking legitimate traffic
   • CDeny all source addresses that are not in the customer's assigned public IP range on the outbound direction
   • DDeny only source addresses from the internal private range on the outbound direction
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A retail company processes credit card transactions and is preparing for a PCI-DSS assessment. The network includes a cardholder data environment (CDE) segment and a corporate segment. The security team needs to implement network segmentation to reduce the PCI-DSS scope. Which firewall configuration best achieves this while meeting PCI-DSS Requirement 1.1.4 (network diagram) and 1.3 (firewall rules)?

   • AImplement a firewall only at the internet edge, not between internal segments
   • BPlace a firewall between the CDE and the corporate network, and restrict traffic to only necessary ports and protocols
   • CConfigure the firewall to allow all traffic between the CDE and corporate network for operational efficiency
   • DUse a single flat network for all systems to simplify management and reduce firewall rule complexity
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A hospital's IT department is implementing PCI-DSS controls for its payment processing systems. They need to ensure that all access to cardholder data is logged and monitored. Which set of actions best meets PCI-DSS Requirement 10 (track and monitor all access to network resources and cardholder data) and Requirement 11 (regularly test security systems)?

   • AEnable detailed logging on firewalls and databases, and configure a SIEM to alert on suspicious access patterns
   • BUse only manual log reviews performed quarterly, without automated alerting
   • CImplement logging only on the internet-facing firewall, not on internal systems
   • DDisable logging on sensitive systems to reduce storage costs and performance impact
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A multinational corporation is aligning its network security infrastructure with ISO 27001 Annex A controls. The security team is focusing on Annex A.13.1.1 (network controls) and A.13.1.3 (segregation in networks). Which infrastructure change best demonstrates compliance with these controls?

   • AAllow all traffic between network segments to ensure seamless communication
   • BImplement VLAN segmentation and firewall rules to separate the DMZ, internal network, and management network
   • CDisable all firewalls to improve network performance and reduce latency
   • DUse a single flat network for all devices to simplify management and reduce complexity
   Reveal Solution Discussion Select an answer first