Network Security Controls and Devices SCE Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A small business with limited IT staff wants to replace several separate security appliances with a single device that provides firewall, antivirus, web filtering, and email filtering. Which solution best fits this requirement?

   • ANetwork access control (NAC) solution
   • BSecurity information and event management (SIEM) system
   • CUnified threat management (UTM) appliance
   • DNext-generation firewall (NGFW) with application awareness
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company hosts a public web server and an internal database server. The web server must be reachable from the internet, but the database server must only be reachable from the web server. Which placement of security controls best meets these requirements?

   • APlace the database server in the DMZ and the web server in the internal network, with a reverse proxy in front of the web server.
   • BPlace both servers in the DMZ and rely on the firewall to block inbound traffic to the database server from the internet.
   • CPlace the web server in the DMZ and the database server in the internal network, with firewall rules allowing only the web server to initiate connections to the database server.
   • DPlace both servers in the internal network and configure the firewall to allow inbound HTTPS to the web server and outbound SQL from the web server to the database server.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the primary purpose of a honeypot?

   • ATo block malicious traffic at the perimeter
   • BTo lure attackers and study their behavior
   • CTo encrypt sensitive data
   • DTo balance traffic across servers
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security analyst is troubleshooting a suspected malware infection that communicates with a command-and-control server. The analyst wants to detect the communication and correlate it with DNS logs to identify infected hosts. Which control should be used?

   • AUse a load balancer to distribute traffic to a honeypot.
   • BInstall a firewall to block all outbound traffic to unknown IPs.
   • CDeploy an IDS with a signature for the C2 domain and forward alerts to a SIEM that ingests DNS logs.
   • DConfigure a VPN to encrypt all outbound traffic.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security engineer needs to block a known exploit that sends a malformed TCP packet to a critical server. The exploit signature is well-defined, but the traffic is encrypted with TLS. The engineer wants to stop the attack without affecting legitimate encrypted traffic. Which control is most appropriate?

   • AUse a honeypot to divert the attack to a decoy server.
   • BPlace an IDS on a SPAN port and configure it to send alerts to the security team.
   • CDeploy an IPS in inline mode with a signature rule for the malformed TCP packet.
   • DConfigure a packet-filtering firewall to block all TCP traffic to the server.
   Reveal Solution Discussion Select an answer first