Network Defenses GDSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary security benefit of network segmentation?

   • AIt limits the spread of attacks by isolating network segments and enforcing traffic policies between them
   • BIt allows all devices to communicate freely while encrypting traffic between segments
   • CIt increases the speed of all network traffic by reducing the number of devices on each segment
   • DIt eliminates the need for firewalls by physically separating all critical systems
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company wants to allow external partners to access a specific application server on an internal network, but only from a known set of partner IP addresses. The application uses a non-standard TCP port. Which firewall configuration should be used?

   • AUse a VPN for partner access and then allow all traffic from the VPN subnet to the application server.
   • BCreate an inbound rule on the perimeter firewall that allows TCP traffic to the application server's IP on the specific port, with source restricted to the partner IP range.
   • CPlace the application server in the DMZ and allow inbound traffic on all ports from the partner IP range.
   • DCreate a rule that allows all traffic from the partner IP range to the internal network.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is implementing remote access for contractors. The security policy requires that only company-issued laptops can connect, and that the contractors' traffic is encrypted. They also want to ensure that if a laptop is lost, it cannot be used to access the network. Which solution best meets all requirements?

   • AUse a VPN with username and password authentication only.
   • BProvide remote access via a web portal that requires multi-factor authentication.
   • CDeploy a VPN that requires client certificates installed on company-issued laptops, and integrate with a NAC solution that checks device posture before allowing VPN access.
   • DSet up a site-to-site VPN between the contractor's home router and the corporate firewall.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is designing a defense-in-depth strategy for its data center. The strategy must protect against both external attackers and insider threats. The security architect is considering multiple layers, including perimeter firewalls, internal segmentation, host-based security, and monitoring. Which combination of controls provides the most comprehensive defense-in-depth?

   • AHost-based intrusion detection on all servers, with no network-level controls.
   • BInternal segmentation only, with no perimeter firewall.
   • CPerimeter firewall, internal firewalls between application tiers, host-based firewalls, and centralized logging with SIEM correlation.
   • DPerimeter firewall and a strong password policy for all users.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the key difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

   • AAn IDS is always deployed inline, while an IPS is deployed out-of-band
   • BAn IDS can block traffic, while an IPS can only generate alerts
   • CAn IDS uses signatures, while an IPS uses only behavioral analysis
   • DAn IDS is passive and only alerts on suspicious activity, while an IPS is inline and can actively block or drop malicious traffic
   Reveal Solution Discussion Select an answer first