Network Defenses GDSA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is designing a secure network architecture for a new office. The security architect wants to apply the principle of separation of duties to network administration. Which approach best achieves this?

   • ADivide firewall administration among two teams: one team manages rule changes and another team approves and audits the changes.
   • BUse a single firewall administrator account shared by the network team.
   • CImplement role-based access control (RBAC) on the firewall, but allow the same administrator to approve their own changes.
   • DAllow the network administrator to manage both firewall rules and security monitoring tools.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company allows employees to work from home. They must access internal applications securely over the internet. The security team wants to ensure that only authorized users can connect and that all traffic between the employee's device and the corporate network is encrypted. Which solution should they implement?

   • ADeploy a VPN gateway that requires certificate-based authentication and uses IPsec tunnels for all remote access traffic.
   • BExpose the internal applications directly to the internet with HTTPS and rely on the application's built-in user authentication.
   • CConfigure a firewall rule that allows remote users to connect to internal servers using their public IP addresses.
   • DUse a remote desktop gateway that allows users to connect to their office desktops without a VPN.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of security logging in network defense?

   • ATo automatically block malicious IP addresses
   • BTo provide a record of events that can be used for forensic investigation and compliance
   • CTo encrypt sensitive data stored on network devices
   • DTo reduce the volume of network traffic by filtering out non-essential packets
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary purpose of a defense-in-depth strategy in network security?

   • ATo ensure that all security controls are deployed at the network perimeter only
   • BTo rely on a single, highly effective security control to stop all attacks
   • CTo eliminate the need for monitoring by preventing all attacks at the boundary
   • DTo create multiple layers of security controls so that if one layer fails, others still provide protection
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security engineer is evaluating whether to deploy an IDS or an IPS on the internal network. The main concern is that the network carries time-sensitive VoIP traffic, and any added latency could degrade call quality. The team also wants to be able to detect and alert on suspicious activity without risking disruption. Which choice best meets these needs?

   • ADeploy an IPS in tap mode that only logs alerts without blocking.
   • BDeploy an IDS in passive mode using a SPAN port, so it does not sit in the data path and adds no latency.
   • CDeploy a firewall with application-layer inspection for VoIP traffic.
   • DDeploy an IPS in inline mode with strict blocking rules for all suspicious traffic.
   Reveal Solution Discussion Select an answer first