Firewall Technologies, Architectures, and Best Practices NDE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which technique can be used to bypass a firewall by splitting malicious payloads across multiple small packets?

   • APort forwarding
   • BDefault-deny policy
   • CIP fragmentation
   • DStateful inspection
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst notices that the firewall logs are full of blocked inbound SSH attempts from many different IP addresses. The analyst wants to identify whether any of these attempts were successful. What is the most effective way to determine this?

   • ACheck the firewall's CPU and memory usage during the attack window.
   • BSearch the logs for any 'reset' events on the destination server.
   • CLook for outbound SSH connections from the internal server to the same IPs.
   • DReview the firewall logs for any corresponding 'allow' events for inbound SSH from those source IPs.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A firewall administrator is reviewing the rule base and finds several rules that are no longer in use. According to firewall best practices, what should the administrator do?

   • AMove the unused rules to the top of the rule base to make them easier to find.
   • BRemove the unused rules and document the change in the change management process.
   • CLeave the rules in place because they might be needed again.
   • DDisable the unused rules but keep them in the configuration for future reference.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Where should a firewall be placed to protect a network's public-facing web server while keeping it separate from the internal network?

   • AOn the external network only
   • BOn the internal network only
   • CIn the DMZ
   • DOn a separate VLAN without any firewall
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An attacker is using a technique that encapsulates malicious traffic inside a legitimate protocol, such as HTTP, to bypass a firewall's port-based rules. Which firewall capability is most effective at detecting this?

   • ANetwork address translation (NAT) to hide internal IP addresses.
   • BStateful inspection that tracks the connection state.
   • CDeep packet inspection (DPI) that examines the payload for protocol anomalies and signatures.
   • DPacket filtering based on source and destination IP addresses.
   Reveal Solution Discussion Select an answer first