3.05 Apply Procedural Concepts to Configure Network Firewall Protection 401 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A firewall administrator needs to review all rules in a BIG-IP firewall policy that affect traffic coming from the 192.168.10.0/24 network. The administrator wants to see only the rules that match this source, without manually scrolling through the entire policy. Which feature should be used?

   • ADisable all rules except those with the source and test traffic.
   • BUse the context-specific rule listing filtered by source address.
   • CExport the entire policy to a CSV file and search for the source in a spreadsheet.
   • DCreate a temporary rule that logs all traffic from the source and review the logs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is deploying a BIG-IP device as a network firewall. The security team wants to ensure that only traffic from the internal network can reach a specific application server, and all other traffic should be blocked. The BIG-IP has multiple VLANs configured. What is the first step in configuring firewall protection?

   • ADisable all unused VLANs to reduce the attack surface.
   • BCreate a firewall policy and assign it to the appropriate VLANs.
   • CEnable the firewall on all VLANs by default.
   • DConfigure NAT on the BIG-IP to translate internal addresses.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A firewall administrator is troubleshooting a connectivity issue. A user from 10.2.2.2 cannot reach a server at 192.168.2.2 using FTP. The firewall policy has the following rules in order: 1) Allow FTP from 10.0.0.0/8 to any; 2) Deny all from 10.0.0.0/8 to 192.168.0.0/16; 3) Allow all from any to any. The administrator wants to verify which rule is matching the traffic. What is the best way to determine this?

   • AUse the fw test command to simulate the traffic and see which rule matches.
   • BReview the rule list and manually determine the match.
   • CCheck the firewall logs to see if the traffic was denied.
   • DUse tcpdump to capture the traffic and see if it is dropped.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the context of F5 BIG-IP security, what is the primary role of a network firewall?

   • ATo balance load across multiple servers
   • BTo filter traffic based on a defined set of security rules
   • CTo authenticate users before they access applications
   • DTo encrypt traffic between clients and servers
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   After configuring a new firewall policy on a BIG-IP device, an administrator wants to verify that a specific rule correctly allows HTTP traffic from the internal network to a web server. The administrator has access to the BIG-IP command line. Which tool should be used to test the rule behavior?

   • AUse the ping command from the internal network to the web server.
   • BUse the fw test command to simulate traffic and check the rule match.
   • CUse the tcpdump command to capture traffic and verify the rule action.
   • DUse the curl command from the BIG-IP to the web server.
   Reveal Solution Discussion Select an answer first