Fundamental Layer 3 Defense GDSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A large enterprise uses BGP to connect to two ISPs for redundancy. They have a /22 prefix and want to prevent announcing more-specific routes to the internet, but they also need to accept a customer's /24 route for a joint venture. The security team is concerned about route hijacking. Which BGP security practice should they implement?

   • ADisable BGP and use static routes to the ISPs
   • BApply a prefix-list to filter outbound advertisements to only the /22
   • CUse RPKI to validate route origins and filter invalid routes
   • DConfigure inbound and outbound prefix-lists: allow the customer's /24 inbound, and only advertise the /22 outbound
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When applying an ACL to a router interface, what is the default behavior if no ACL is applied?

   • AAll traffic is permitted
   • BAll traffic is denied
   • COnly traffic from the local network is permitted
   • DTraffic is permitted only if it matches a routing table entry
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A network administrator is designing a secure segmentation plan for a multi-tenant building. They have a /22 block (1024 addresses) and need to create separate subnets for each of 5 tenants, with the largest tenant requiring at least 200 usable IP addresses. They also want to minimize wasted addresses. What subnetting scheme should they use?

   • ACreate one /23 and four /25 subnets
   • BCreate one /24 and four /26 subnets
   • CCreate five /24 subnets
   • DCreate five /25 subnets
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is investigating a smurf attack that is hitting the company's network. The attack involves ICMP echo requests sent to the broadcast address of the network, with the source address spoofed to be the victim's IP. Which mitigation should be implemented to prevent the network from being used as an amplifier?

   • ABlock all ICMP echo requests at the perimeter firewall.
   • BDisable IP directed broadcast on all routers.
   • CEnable uRPF on all interfaces.
   • DConfigure ACLs to deny ICMP traffic from the victim's IP.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A network administrator is configuring a router that connects a trusted internal network to an untrusted external network. The administrator wants to prevent attackers from sending packets with spoofed internal source addresses into the internal network. Which configuration should be applied on the router's external interface?

   • AConfigure NAT to translate all internal addresses to the external interface address.
   • BApply an inbound ACL that denies packets with source addresses matching the internal network prefix.
   • CApply an outbound ACL that denies packets with destination addresses matching the internal network prefix.
   • DEnable uRPF in loose mode on the external interface.
   Reveal Solution Discussion Select an answer first