Network Firewalls and Traffic Inspection GCAD Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key limitation of cloud-native security groups compared to traditional network firewalls?

   • AThey cannot filter traffic based on IP addresses
   • BThey are stateless and require separate inbound and outbound rules
   • CThey lack advanced inspection features like intrusion prevention and application awareness
   • DThey cannot be applied to virtual machines
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which approach is most effective for monitoring firewall logs in a cloud environment?

   • AStoring logs locally on each firewall and never reviewing them
   • BSending logs to a centralized logging service with alerting and search capabilities
   • COnly logging denied traffic and ignoring allowed traffic
   • DDisabling logging to improve firewall performance
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) is investigating a suspected intrusion. The firewall logs show that an internal host made a series of outbound connections to a known malicious IP address on port 445 (SMB). The SOC needs to determine if any data was exfiltrated. What additional data source would be most helpful?

   • AFirewall logs showing the source and destination IP addresses and ports.
   • BDNS logs showing the hostname resolved by the malicious IP.
   • CFull packet capture of the SMB traffic from the internal host.
   • DNetFlow records showing the volume of traffic.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is investigating a potential data breach. The firewall logs show that an internal server made an outbound HTTPS connection to an external IP address that is flagged as malicious. The analyst needs to determine what data was transmitted. What should the analyst do?

   • ACheck the server's web proxy logs for the URL requested.
   • BCheck if the firewall has SSL/TLS inspection enabled and review the decrypted traffic logs.
   • CUse a packet capture tool on the server to capture the traffic.
   • DReview the firewall logs for the source and destination IP addresses and ports.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security engineer is troubleshooting an issue where a stateless firewall is dropping legitimate responses to outbound HTTP requests. The firewall is configured to allow outbound TCP port 80. What is the most likely cause and the appropriate fix?

   • AThe firewall is configured with a default-deny policy that blocks all inbound traffic; change the default policy to allow all traffic.
   • BThe firewall is stateful but the timeout is too short; increase the session timeout to keep the connection alive.
   • CThe firewall is not tracking connection state, so return traffic from the web server is being blocked; add an inbound rule allowing established connections or high ports.
   • DThe firewall is performing deep packet inspection and blocking responses that contain malicious payloads; disable DPI to allow all traffic.
   Reveal Solution Discussion Select an answer first