Network Perimeter Security CND Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is designing a new perimeter network. They have a public web server, an application server that must be accessed by the web server, and a database server that should not be directly accessible from the internet. Which design best meets these requirements?

   • APlace the web and application servers in the DMZ and the database in the internal network, allowing all traffic between the DMZ and internal network.
   • BPlace all servers in the internal network and use port forwarding for the web server.
   • CPlace the database in the DMZ and the web and application servers in the internal network.
   • DPlace the web server in the DMZ, the application server in a second DMZ, and the database server in the internal network.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of tuning an Intrusion Prevention System (IPS)?

   • ATo configure the IPS to block all traffic from external networks
   • BTo increase the number of alerts generated regardless of their accuracy
   • CTo reduce false positives and false negatives while maintaining effective threat detection
   • DTo disable all detection features to improve network performance
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company allows employees to work remotely. The security team wants to ensure that all remote access traffic is encrypted and that only authorized devices can connect. They also want to segment remote users from the internal corporate network until they pass a posture check. Which solution best meets these requirements?

   • AUse a clientless SSL VPN that only provides access to a single web application, with no additional controls.
   • BExpose the internal file server directly to the internet and require employees to use a strong password.
   • CConfigure a site-to-site VPN between the company and each employee's home router.
   • DDeploy a remote-access VPN with certificate-based authentication and place remote users in a quarantine VLAN until posture assessment passes.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is reviewing firewall logs and sees repeated failed connection attempts from an external IP to the company's SSH server. The attempts are spread over several hours. The IDS has not raised an alert. What should the analyst do first?

   • AChange the SSH port to a non-standard port to avoid the scans.
   • BBlock the external IP at the firewall and add a rule to drop further traffic from that source.
   • CDisable SSH access from the internet entirely.
   • DIgnore the attempts because the IDS did not alert.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of a DMZ (demilitarized zone) in a perimeter network design?

   • ATo connect the internal network directly to the internet without any security controls
   • BTo store sensitive internal data with no external access
   • CTo replace the need for a firewall
   • DTo host services that are accessible from the internet while isolating them from the internal network
   Reveal Solution Discussion Select an answer first