Network Firewalls and Traffic Inspection GCAD Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Why is SSL/TLS inspection necessary for effective traffic inspection in modern networks?

   • ABecause it replaces the need for deep packet inspection
   • BBecause SSL/TLS inspection is required by all compliance standards
   • CBecause encrypted traffic can hide malicious content from traditional inspection methods
   • DBecause it speeds up network traffic
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary difference between a stateful and a stateless firewall?

   • AStateless firewalls are always faster than stateful firewalls
   • BStateless firewalls are used only in cloud environments, while stateful firewalls are used on-premises
   • CStateful firewalls only filter based on IP addresses, while stateless firewalls inspect application data
   • DStateful firewalls track the state of active connections, while stateless firewalls evaluate each packet independently
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A cloud architect is designing a VPC with multiple subnets. They need to block traffic from a specific IP range to a specific subnet, but they also need to allow that same IP range to reach other subnets. They want to use cloud-native firewall services. Which combination of services should they use?

   • APlace a network virtual appliance in front of the entire VPC and configure a deny rule for the IP range.
   • BUse a security group on the specific subnet's instances with an allow rule for all traffic except the IP range.
   • CUse a security group on the specific subnet's instances with a deny rule for the IP range.
   • DUse a network ACL on the specific subnet with a deny rule for the IP range, and ensure other subnets have no such deny rule.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has a firewall rule that allows all outbound traffic from a development subnet. During a security review, the team finds that this rule has been in place for over a year and is no longer needed. According to firewall policy management best practices, what should they do?

   • AChange the rule to allow only HTTP and HTTPS traffic as a compromise.
   • BKeep the rule because it might be needed in the future and removing it could break applications.
   • CRemove the rule immediately and monitor logs for any legitimate traffic that might be blocked.
   • DDisable the rule but do not delete it, so it can be re-enabled quickly if needed.
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A company is using AWS and wants to block traffic from a specific country. They have a web application behind an Application Load Balancer (ALB). Which approach is most effective?

   • AUse a network ACL on the ALB's subnet to block the country's IP ranges.
   • BUse a security group on the ALB to block the country's IP ranges.
   • CUse AWS Network Firewall to block the country's IP ranges.
   • DUse AWS WAF on the ALB with a geo-match rule to block the country.
   Reveal Solution Discussion Select an answer first