Network Security Controls and Devices SCE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which network zone is typically used to host public-facing web servers?

   • AManagement network
   • BInternal LAN
   • CGuest network
   • DDMZ
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company has a strict policy to block all social media traffic, but the marketing team needs access to a specific social media management tool that uses the same domain and IP ranges as the social media platforms. The security team must allow the tool while blocking the platforms. Which control should be implemented?

   • AUse a web security gateway to allow the tool's URL and block all other social media URLs.
   • BSet up a VPN for the marketing team to access the tool.
   • CConfigure a stateful firewall to allow traffic to the tool's IP ranges and block all other social media IPs.
   • DDeploy an NGFW with application-level rules that identify the specific tool by its unique traffic signature.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which firewall type is capable of inspecting the actual content of application-layer protocols, such as HTTP, to block malicious payloads?

   • ACircuit-level firewall
   • BApplication firewall
   • CPacket filtering firewall
   • DStateful firewall
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company runs a critical web application on a single server. During a DDoS attack, the server becomes overwhelmed and the application becomes unavailable. The security team wants to maintain availability during future attacks, but the budget is limited. Which combination of controls provides the most cost-effective mitigation?

   • ASubscribe to a cloud-based DDoS protection service and add a second server behind a load balancer.
   • BPurchase a high-end on-premises firewall with DDoS mitigation features.
   • CDeploy an IPS in inline mode to block DDoS traffic.
   • DIncrease the server's bandwidth and CPU capacity.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A remote employee needs to access internal resources securely over the internet. The company wants to ensure that all traffic between the employee's laptop and the corporate network is encrypted and that the employee's device is checked for compliance before it can connect. Which two controls should be combined?

   • AUse a firewall with a rule to allow remote desktop protocol (RDP) from any source.
   • BSet up a honeypot to attract attackers and monitor their behavior.
   • CDeploy a VPN for encrypted tunneling and use NAC to enforce device compliance before granting access.
   • DInstall a SIEM to monitor remote access logs.
   Reveal Solution Discussion Select an answer first