Fundamental Layer 3 Defense GDSA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which ICMP message type is commonly used in a smurf attack to amplify traffic against a victim?

   • AICMP Redirect
   • BICMP Echo Request
   • CICMP Destination Unreachable
   • DICMP Time Exceeded
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an effective mitigation against ICMP-based reconnaissance, such as ping sweeps?

   • ADisabling IP routing on all hosts
   • BBlocking all ICMP traffic at the firewall
   • CUsing static ARP entries for all hosts
   • DRate-limiting ICMP traffic and filtering unnecessary ICMP types
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A network administrator wants to prevent a router from forwarding packets that are destined for a network that is not explicitly listed in the routing table. Which Layer 3 defense strategy directly addresses this?

   • ADisabling IP directed broadcast on interfaces
   • BConfiguring a default route to a null interface
   • CImplementing unicast Reverse Path Forwarding (uRPF)
   • DApplying a route filter that denies the advertisement of unknown networks
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A small company has a single public IP address and 50 internal hosts that need outbound internet access. The security policy requires that internal hosts cannot be reached directly from the internet, but the company also needs to host a web server that must be reachable from the internet. Which NAT configuration should be used?

   • AConfigure static NAT for all 50 internal hosts to the single public IP address.
   • BConfigure dynamic NAT with a pool of 50 public addresses and a static NAT entry for the web server.
   • CConfigure PAT for outbound traffic and place the web server in a DMZ with no NAT.
   • DConfigure PAT (overload) for outbound traffic and a static NAT (port forwarding) entry for the web server.
   Reveal Solution Discussion Select an answer first
6. 35expert · medium

   A firewall administrator is configuring ACLs on a router that connects a DMZ to the internal network. The DMZ contains a web server (10.0.1.10) and an application server (10.0.1.20). The internal network is 10.0.2.0/24. The requirement is to allow internal users to access the web server on TCP 443 and the application server on TCP 3389 (RDP), but block all other traffic. The ACL is evaluated top-down. Which ACL configuration correctly implements this policy?

   • Apermit tcp host 10.0.1.10 eq 443 10.0.2.0 0.0.0.255 / permit tcp host 10.0.1.20 eq 3389 10.0.2.0 0.0.0.255 / deny ip any any
   • Bpermit ip 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255 / deny ip any any
   • Cpermit tcp 10.0.2.0 0.0.0.255 host 10.0.1.10 eq 443 / permit tcp 10.0.2.0 0.0.0.255 host 10.0.1.20 eq 3389 / deny ip any any
   • Dpermit tcp any host 10.0.1.10 eq 443 / permit tcp any host 10.0.1.20 eq 3389 / deny ip any any
   Reveal Solution Discussion Select an answer first