Network Security CCISO Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which practice is a key component of hardening network devices?

   • ADisabling unnecessary services and ports
   • BUsing default passwords for ease of management
   • CEnabling all available features to maximize functionality
   • DAllowing remote management from any IP address
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A hospital is implementing network access control (NAC) for its wired network. The NAC solution must ensure that all devices connecting to the network are compliant with the hospital's security policy, which requires up-to-date antivirus software and the latest operating system patches. The hospital also wants to allow guest devices to access only the internet. Which NAC configuration best meets these requirements?

   • AUse a network firewall to block non-compliant devices based on their IP address.
   • BUse 802.1X with a RADIUS server that checks device posture and assigns compliant devices to the internal VLAN and non-compliant or guest devices to a quarantine VLAN with internet-only access.
   • CUse a captive portal for all devices and require users to enter a username and password, but do not check device posture.
   • DUse MAC address filtering to allow only known devices and manually add guest devices to an allowlist.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is deploying a new web application that must be accessible from the internet. The security team wants to protect the internal network from direct exposure while still allowing the application to reach backend databases. Which network design should the team implement?

   • APlace the web server in a DMZ and the database in the internal network, with firewall rules allowing only the web server to reach the database on the required port.
   • BPlace both the web server and the database in the internal network, and open the firewall port for the database to the internet so the web app can function.
   • CPlace both servers in the DMZ and allow all traffic between them without firewall restrictions.
   • DPlace the database in the DMZ and the web server in the internal network, with a firewall rule allowing the database to initiate connections to the web server.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst notices a sudden spike in outbound DNS queries from a single internal workstation to a domain that has only been registered for 24 hours. The workstation is also sending a large volume of data to an external IP address on port 443. The analyst suspects a malware infection. Which immediate action best balances the need to contain the threat with the need to preserve evidence?

   • APower off the workstation immediately to stop the data exfiltration, then begin the forensic investigation.
   • BUpdate the firewall rule to block all outbound DNS from the workstation, then wait to see if the issue resolves.
   • CBlock the external IP address at the firewall and continue monitoring the workstation for additional malicious activity.
   • DIsolate the workstation from the network by disabling its switch port, then capture a memory image and network logs for analysis.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network administrator is setting up monitoring for a new server. The administrator wants to detect potential port scans and brute-force attacks. Which monitoring approach is most effective?

   • ADisable logging to improve server performance.
   • BEnable logging on the firewall and server, and use an intrusion detection system (IDS) to analyze traffic patterns for anomalies.
   • CUse only a packet sniffer to capture all traffic and store it indefinitely.
   • DRely on the server's built-in firewall logs only.
   Reveal Solution Discussion Select an answer first