Firewall Technologies, Architectures, and Best Practices NDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization wants to deploy a DMZ with two firewalls: one connected to the internet and one connected to the internal network. The DMZ sits between them. What is this architecture commonly called?

   • ADual-homed host
   • BMulti-homed firewall
   • CBastion host
   • DScreened subnet (or DMZ) with dual firewalls
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An organization is choosing between a screened subnet and a dual-homed host architecture. They have a high-security requirement and a moderate budget. Which factor most strongly favors the screened subnet?

   • AIt requires less administrative effort because there is only one firewall to manage.
   • BIt eliminates the need for a DMZ.
   • CIt allows the DMZ and internal network to share the same security policy.
   • DIt provides defense in depth by using two firewalls, so a compromise of the DMZ does not directly expose the internal network.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A firewall administrator is troubleshooting a connectivity issue. Users on the internal network can access the internet, but they cannot access a specific internal server on port 3389 (RDP). The firewall logs show no blocked packets for that traffic. What is the most likely cause?

   • AThe firewall is not inspecting traffic between internal network segments because it is not in the path.
   • BThe firewall's default-deny policy is blocking the traffic without logging.
   • CThe firewall's stateful inspection is dropping the packets due to an invalid state.
   • DThe firewall is blocking the traffic but not logging it.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which firewall policy principle states that all traffic should be denied unless it is explicitly allowed?

   • ADefault-deny
   • BDefense in depth
   • CLeast privilege
   • DFail-open
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network administrator is reviewing firewall rules and finds several rules that allow inbound RDP from the entire internet to internal servers. These rules were added months ago for a temporary remote-access project that has ended. What is the most appropriate action according to firewall best practices?

   • AAdd a logging rule to monitor who uses RDP before deciding.
   • BChange the source from 'any' to a specific IP range to reduce exposure.
   • CLeave the rules in place but disable them for now in case they are needed again.
   • DRemove the obsolete rules immediately and verify that no legitimate service depends on them.
   Reveal Solution Discussion Select an answer first