Network Security Fundamentals CCT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the core idea of the defense-in-depth security strategy?

   • AUsing a single strong security control to protect the network
   • BFocusing only on perimeter security
   • CLayering multiple security controls so that if one fails, others still provide protection
   • DRelying solely on encryption for all security
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A small business has a single internet connection and a firewall. They want to connect two office locations securely over the internet. Which device or feature should they configure on each firewall?

   • AA remote-access VPN
   • BPort forwarding
   • CA demilitarized zone (DMZ)
   • DA site-to-site VPN tunnel
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A financial institution must comply with regulations that require separating customer data from general corporate data. The network team proposes using VLANs to segment the network. However, the compliance officer insists that VLANs alone are insufficient because they rely on a single switch. Which additional control would best address the compliance officer's concern?

   • AEnable VLAN trunking with 802.1Q tagging.
   • BUse separate physical switches for each security domain.
   • CDeploy an intrusion prevention system (IPS) on the VLAN trunk.
   • DImplement private VLANs to isolate ports within the same VLAN.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a DDoS attack targeting the company's web server. The attack traffic consists of large UDP packets sent to random high-numbered ports on the server. The server is behind a load balancer. Which mitigation is most effective while minimizing impact on legitimate traffic?

   • AIncrease the server's UDP buffer size
   • BBlock all UDP traffic at the firewall
   • CDisable the server's UDP ports
   • DConfigure rate limiting for UDP traffic on the load balancer
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A small business hosts its own web server and uses a single internet connection. After a spike in traffic, the server becomes unresponsive. The administrator checks the firewall logs and sees thousands of SYN packets from many different source IPs, but no corresponding ACK packets. Which action would most directly mitigate this specific attack while preserving legitimate access?

   • AConfigure the firewall to drop all incoming TCP traffic on port 80 for the next hour.
   • BEnable SYN cookies on the firewall or server to handle the half-open connection flood.
   • CIncrease the server's TCP backlog queue size to accommodate more pending connections.
   • DBlock all traffic from the source IPs that appear in the firewall logs.
   Reveal Solution Discussion Select an answer first