Remote Access and Connections CSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company uses a bastion host for SSH access to internal Linux servers. The bastion host is in a public subnet. What is the most secure way to control access to the bastion host?

   • AUse the same SSH key for all admins.
   • BDisable the firewall on the bastion host.
   • CRestrict the NSG on the bastion subnet to allow SSH only from corporate IP ranges.
   • DAllow SSH from any source and rely on strong passwords.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst needs to detect when a remote user's credentials are used from an unusual location. Which combination of actions is most effective?

   • AUse network security group flow logs only.
   • BEnable resource logs for all VMs.
   • CSet up a VPN and require MFA.
   • DEnable sign-in logs and configure alerts for anomalous sign-in events.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has a remote-access VPN that uses IPsec with pre-shared keys. After a security review, they want to improve authentication and reduce the risk of compromised keys. Which change is most effective?

   • AMove to an SSL/TLS VPN without changing authentication.
   • BIncrease the pre-shared key length to 64 characters.
   • CAdd a second pre-shared key for each user.
   • DSwitch to certificate-based authentication for the IPsec VPN.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company has a remote office that needs secure access to resources in a cloud VPC. The remote office has a fixed public IP and a hardware firewall. The company wants a persistent, encrypted connection between the office network and the cloud VPC, and also wants to restrict traffic to specific subnets. Which approach should be used?

   • ASet up a remote-access SSL VPN and have each user connect individually from their workstation.
   • BUse SSH tunneling from the office firewall to a bastion host in the cloud.
   • CConfigure a site-to-site IPsec VPN tunnel between the office firewall and the cloud VPN gateway, and use network ACLs to limit traffic to allowed subnets.
   • DCreate a VPC peering connection between the office network and the cloud VPC.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has a hybrid network with a site-to-site VPN to Azure. Remote users need to access Azure VMs and also on-premises resources. The current remote-access VPN is an SSL VPN that only reaches Azure. What is the most efficient solution?

   • AMove all on-premises resources to Azure.
   • BExtend the SSL VPN to also route traffic to on-premises through the site-to-site tunnel.
   • CUse a site-to-site VPN for each remote user.
   • DDeploy a second remote-access VPN for on-premises resources.
   Reveal Solution Discussion Select an answer first