Network Proxies and Firewalls GDSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company wants to provide a single entry point for multiple internal web applications and offload TLS certificate management. They also want to cache static content to reduce backend load. Which solution should they implement?

   • ADeploy a reverse proxy in front of the internal web applications.
   • BDeploy a forward proxy and configure each application to use it.
   • CUse a packet-filtering firewall to load balance traffic.
   • DUse a stateful firewall with NAT for each application.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An organization is choosing between a stateful firewall and an application-layer firewall for its perimeter. The organization's main concern is preventing advanced persistent threats that use encrypted tunnels. Which factor most strongly favors an application-layer firewall?

   • AThe ability to track connection state.
   • BThe ability to operate in transparent mode.
   • CThe ability to perform TLS interception and inspect encrypted traffic.
   • DThe ability to filter based on source and destination IP addresses.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is designing a layered defense for a hybrid network. They have a stateful firewall at the edge, a forward proxy for outbound web traffic, and an intrusion detection system (IDS) on the internal network. They need to identify a gap: the firewall allows outbound HTTPS, and the proxy performs SSL inspection and URL filtering. However, the team is concerned about malware that uses non-standard ports or protocols that bypass the proxy. Which additional control would best address this gap?

   • AIncrease the IDS signature set.
   • BConfigure the firewall to block all non-standard ports.
   • CEnable application-layer inspection on the firewall to identify and control protocols regardless of port.
   • DAdd more URL filtering categories to the proxy.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team wants to prevent employees from uploading sensitive files to external cloud storage via the web. They have a forward proxy that can inspect HTTPS traffic. Which control should they enable?

   • ABlock all HTTPS traffic to external domains.
   • BUse a stateful firewall to block all outbound traffic on port 443.
   • CEnable TLS interception and content inspection to detect and block uploads to known cloud storage domains.
   • DDisable TLS interception to increase performance.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a typical enterprise network, where is a forward proxy most commonly placed?

   • ABetween the internal clients and the internet to control outbound traffic
   • BIn the DMZ to load-balance traffic between multiple application servers
   • COn each individual client machine to inspect local traffic
   • DIn front of the web servers to protect them from external attacks
   Reveal Solution Discussion Select an answer first