Network Firewalls and Traffic Inspection GCAD Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   Which feature is characteristic of a Next-Generation Firewall (NGFW) beyond traditional stateful filtering?

   • AStatic routing between virtual networks
   • BLoad balancing across multiple servers
   • CApplication awareness and intrusion prevention
   • DOnly packet filtering based on IP addresses and ports
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is migrating a legacy application to the cloud. The application requires direct access from the internet to a database server, which is a security concern. The architect decides to place the database in a private subnet and use a bastion host for administrative access. Which additional firewall placement strategy should be used to protect the database from the internet?

   • APlace a network ACL on the database subnet that denies all inbound traffic from the internet, and allow only traffic from the application tier.
   • BPlace the database in the same subnet as the bastion host and rely on the bastion host's security.
   • CPlace a firewall appliance in front of the database subnet and configure it to allow all traffic from the internet.
   • DPlace a security group on the database instance that allows all inbound traffic from the internet.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is deploying a three-tier web application in a cloud VPC. The web tier must be reachable from the internet, the application tier must only be reachable from the web tier, and the database tier must only be reachable from the application tier. The security team wants to enforce this with cloud-native constructs only. Which approach should they use?

   • APlace a single network virtual appliance in front of the web tier and rely on its stateful inspection to protect all tiers.
   • BUse security groups on each tier's instances and network ACLs on each subnet, with rules that allow only the required source-destination pairs.
   • CConfigure security groups only on the database tier and leave the web and application tiers in the same subnet with no additional controls.
   • DPlace a firewall appliance between each tier and configure routing so all traffic passes through it, but allow all traffic within the same subnet.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In a cloud environment, a stateless network ACL is used to filter traffic. Which statement accurately describes a limitation of this approach compared to a stateful firewall?

   • AIt cannot filter based on source IP address
   • BIt requires explicit rules for both inbound and outbound traffic for each direction of a connection
   • CIt cannot be used in a virtual private cloud
   • DIt automatically allows return traffic for any allowed outbound connection
   Reveal Solution Discussion Select an answer first