Firewall Technologies, Architectures, and Best Practices NDE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is investigating a potential data exfiltration. The firewall logs show that an internal host has been sending large amounts of data to an external IP on port 53 (DNS). The firewall allows outbound DNS. The analyst suspects the data is being tunneled through DNS. Which action would best confirm this suspicion?

   • AInspect the DNS payloads for encoded data or unusual query patterns, such as long subdomains or TXT record queries.
   • BBlock all outbound DNS traffic to that external IP.
   • CLook for outbound connections on port 53 from other internal hosts.
   • DCheck the firewall's CPU usage during the data transfer.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which firewall placement is most appropriate for protecting an internal network from external threats?

   • AOn each individual host only
   • BAt the perimeter, between the internal network and the internet
   • COnly between internal subnets
   • DAt the ISP's data center
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team wants to ensure that firewall rule changes are reviewed and approved before implementation. Which practice best supports this?

   • AImplement a formal change management process that includes peer review and approval for all firewall rule changes.
   • BUse automated tools to make changes without human review.
   • CAllow administrators to make changes directly and document them after implementation.
   • DReview firewall rules only during annual security audits.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company needs to block a specific application that uses dynamic ports and encryption, making it difficult to identify by port number. They also need to maintain high throughput for legitimate traffic. Which firewall approach is most effective?

   • AUse a packet-filtering firewall and block the application's known port ranges.
   • BDeploy a next-generation firewall (NGFW) with application identification and SSL inspection.
   • CUse an application-level proxy and require all traffic to pass through it, but do not inspect encrypted traffic.
   • DUse a stateful inspection firewall and block all traffic to the application's server IP addresses.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A small business wants to place a web server that must be accessible from the internet, while keeping the internal office network isolated. They have one firewall device and limited budget. Which architecture should they implement?

   • ASingle-homed host: connect the web server directly to the internal network and use the firewall only for outbound traffic.
   • BMulti-homed host: connect the web server to the same interface as the internal network, relying on the firewall's stateful inspection to separate traffic.
   • CScreened subnet: place the web server on a separate DMZ segment between two firewalls, with the internal network behind the second firewall.
   • DDual-homed host: place the web server on a separate interface of the firewall, with the internal network on another interface, and enforce strict rules between all three zones.
   Reveal Solution Discussion Select an answer first