Network Defenses GDSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a remote-access VPN, what is the purpose of the encrypted tunnel?

   • ATo compress data so that it transfers faster over the internet
   • BTo allow the remote user to bypass the corporate firewall
   • CTo protect the confidentiality and integrity of data as it traverses public networks
   • DTo provide a dedicated physical circuit between the user and the corporate network
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A hospital wants to ensure that only authorized, compliant devices can connect to its internal network. They need to prevent non-compliant personal devices from gaining access while allowing staff devices that meet security policies. Which control should be implemented?

   • ADeploy a network access control (NAC) solution that checks device posture and enforces policy before granting network access.
   • BRequire all staff to use a VPN to access the internal network from any device.
   • CImplement a firewall rule that blocks all traffic from unknown MAC addresses.
   • DUse an intrusion prevention system (IPS) to detect and block non-compliant devices after they connect.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is deploying a new web application in a DMZ. The security team wants to protect the application from common web attacks while also ensuring that legitimate traffic is not blocked. They have a limited budget and cannot afford both a dedicated WAF and an IPS. Which approach provides the best balance of security and cost?

   • ADeploy an IPS in inline mode before the web servers and use a separate open-source firewall for access control.
   • BDeploy a next-generation firewall (NGFW) with integrated intrusion prevention and application-layer inspection at the DMZ boundary.
   • CDeploy a network-based IDS to monitor traffic and manually block malicious IPs in the firewall.
   • DDeploy a traditional stateful firewall and rely on the web application's built-in input validation.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company wants to protect its internal network from external threats. They currently have a perimeter firewall. To implement defense-in-depth, which additional control should they add?

   • ARemove the firewall and rely solely on host-based security controls on each server.
   • BDeploy an intrusion prevention system (IPS) behind the firewall to inspect and block malicious traffic that passes through.
   • CAdd a second firewall with identical rules to the first, but do not configure any logging.
   • DUse a network access control (NAC) solution to block all external traffic before it reaches the firewall.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is designing a new network architecture. They want to place a web server in a DMZ and an application server in an internal segment. The web server needs to communicate with the application server on a specific port. Which firewall configuration is most appropriate?

   • APlace the web server and application server in the same DMZ segment, and allow all traffic between them.
   • BAllow all traffic from the internet to the internal segment, and restrict traffic from the DMZ to the internal segment.
   • CAllow traffic from the web server to the application server on the specific port, and deny all other traffic from the DMZ to the internal segment.
   • DAllow all traffic from the DMZ to the internal segment, and restrict traffic from the internet to the DMZ.
   Reveal Solution Discussion Select an answer first