Network Firewalls and Traffic Inspection GCAD Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which practice supports compliance and auditability in firewall policy management?

   • ASharing administrative credentials among team members
   • BDeleting firewall logs after 24 hours
   • CUsing a change management process that includes approval and documentation
   • DMaking changes directly in production without review
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has a hybrid cloud environment with an on-premises data center and a VPC in AWS. They want to enforce consistent firewall policies across both environments. They also need to ensure that firewall rule changes are reviewed and approved before deployment. Which approach best meets these requirements?

   • AManually configure each firewall independently, using the same rule set copied from a template.
   • BDeploy a single virtual firewall instance in the VPC and route all on-premises traffic through it.
   • CUse AWS Network Firewall for the VPC and a separate on-premises firewall, with no integration.
   • DUse a centralized firewall management platform that supports both on-premises and cloud firewalls, with a change management workflow.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A network engineer is designing a firewall solution for a high-throughput data replication link between two data centers. The link carries large volumes of UDP traffic. The security team requires that only specific source and destination IP/port combinations be allowed. They also want to minimize latency and overhead. Which firewall type is most appropriate?

   • AStateless firewall with simple allow rules for the required IP/port pairs.
   • BNext-generation firewall with application identification and IPS.
   • CStateful firewall with strict connection tracking.
   • DA cloud-native security group, since it is stateful and easy to manage.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security engineer is configuring an NGFW to protect a web application. They want to block SQL injection attempts. Which NGFW feature should they enable?

   • AIntrusion prevention system (IPS) with signatures for SQL injection.
   • BApplication awareness to identify the web application.
   • CSSL/TLS inspection to decrypt HTTPS traffic.
   • DStateful packet filtering to allow HTTP traffic.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A large enterprise is deploying a multi-account AWS environment. They need to inspect all traffic between VPCs and to the internet, and they want to enforce consistent security policies across all accounts. They also need to support non-HTTP protocols and provide intrusion prevention. Which architecture should they choose?

   • AUse VPC peering between all VPCs and rely on security groups for traffic filtering.
   • BUse AWS Network Firewall in each VPC, with separate rule groups for each account.
   • CDeploy a firewall appliance in each VPC and peer them all together.
   • DCentralized inspection VPC with AWS Transit Gateway and a third-party NGFW for all inter-VPC and internet-bound traffic.
   Reveal Solution Discussion Select an answer first