Firewall Technologies, Architectures, and Best Practices NDE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of setting up alerts on a firewall?

   • ATo replace the need for log analysis
   • BTo automatically block all traffic
   • CTo notify administrators of potential security events
   • DTo increase firewall throughput
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company's firewall rule base has grown to over 1,000 rules, and the security team is concerned about rule conflicts and performance. Which approach best addresses this?

   • AConduct a rule review to identify and remove redundant or conflicting rules, and consolidate where possible.
   • BMove all rules to a single rule to simplify management.
   • CIncrease the firewall's logging level to capture all traffic and analyze it later.
   • DReplace the firewall with a newer model that has more processing power.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A firewall administrator is reviewing the firewall rule base and finds that there are many rules that are no longer used. The administrator wants to improve security and maintainability. Which approach is the most effective?

   • AConsolidate all rules into a single broad rule to simplify management.
   • BPerform a rule review, remove unused rules, and document the purpose of each remaining rule.
   • CIncrease logging on all rules to identify usage before removing any.
   • DDisable unused rules instead of removing them.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A firewall administrator is configuring rules for a web application that uses both HTTP and HTTPS. The security policy requires that all web traffic be inspected for malware, but the team is concerned about performance. Which rule configuration best balances security and performance?

   • AAllow HTTPS traffic with SSL inspection and malware filtering; allow HTTP traffic with malware filtering; deny all other traffic.
   • BBlock HTTPS traffic and require all users to use HTTP so that traffic can be inspected.
   • CAllow all traffic on ports 80 and 443 without inspection to maximize performance.
   • DAllow HTTPS traffic without inspection to improve performance; allow HTTP traffic with malware filtering.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst notices that the firewall logs show a high volume of fragmented packets being sent to an internal server. The analyst suspects an evasion attempt. What should the analyst do first?

   • AImmediately block all fragmented packets at the firewall.
   • BIncrease the firewall's logging level to capture all packet payloads.
   • CEnable logging and alerts for fragmented packets, then review the source and destination patterns.
   • DDisable the firewall's fragmentation reassembly feature.
   Reveal Solution Discussion Select an answer first