Network Firewalls and Traffic Inspection GCAD Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a primary purpose of collecting and analyzing firewall logs?

   • ATo automatically block all malicious traffic
   • BTo detect anomalies and support incident response
   • CTo replace the need for intrusion detection systems
   • DTo increase network bandwidth
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security administrator is managing firewall rules for a DMZ. They notice that a rule allowing inbound RDP to a management server has been in place for several months and is no longer needed. What is the best practice for handling this rule?

   • ARemove the rule immediately and document the change.
   • BDisable the rule and monitor logs to ensure no legitimate traffic is affected before removing it.
   • CMove the rule to the bottom of the rule list to minimize its impact.
   • DLeave the rule in place but change the source IP to a more restrictive range.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network administrator is configuring a firewall to allow FTP traffic. The firewall is stateful. What additional consideration must be made for FTP compared to HTTP?

   • AFTP uses multiple connections, so the firewall must track the data connection as well as the control connection.
   • BFTP traffic is always encrypted, so the firewall must perform SSL/TLS inspection.
   • CFTP is a stateless protocol, so the firewall does not need to track connections.
   • DFTP uses a single connection, so the firewall only needs to allow the control port.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a best practice for managing firewall rules in a cloud environment?

   • AReview and remove unused or redundant rules regularly
   • BAvoid documenting rule changes to save time
   • CUse the most permissive rules possible to avoid blocking legitimate traffic
   • DPlace all rules in a single flat list without grouping
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does application awareness in an NGFW enhance traffic inspection compared to a traditional port-based firewall?

   • AIt only inspects traffic on well-known ports like 80 and 443
   • BIt allows the firewall to identify and control traffic based on the application, even if it uses non-standard ports
   • CIt eliminates the need for any firewall rules
   • DIt blocks all traffic that is not HTTP or HTTPS
   Reveal Solution Discussion Select an answer first