Network Proxies and Firewalls GDSA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A network engineer is configuring a firewall for a new branch office. The requirements are: allow internal users to access the internet via HTTPS, allow remote VPN users to access internal resources, and block all other inbound traffic. Which rule set best meets these requirements?

   • AAllow inbound HTTPS and outbound HTTPS only.
   • BAllow outbound HTTPS and deny all inbound traffic, including VPN.
   • CAllow all outbound traffic and allow all inbound traffic.
   • DAllow outbound HTTPS, allow inbound VPN, and deny all other inbound traffic.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization wants to enforce acceptable use policies by blocking access to known malicious and non-work-related websites. They also need to log all web requests for later security analysis. Which proxy configuration should they use?

   • ADeploy a packet-filtering firewall that blocks ports 80 and 443.
   • BConfigure a forward proxy with URL filtering and enable access logging.
   • CConfigure a reverse proxy with content inspection and enable error logging.
   • DUse a stateful firewall with application-layer inspection to block specific domains.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization wants to place a public web server in a DMZ. The firewall must allow HTTPS from the internet to the web server, but the web server must not initiate outbound connections to the internal network. Which firewall deployment architecture best supports this?

   • ATransparent firewall bridging the DMZ and inside networks with no routing.
   • BRouted firewall with three interfaces: outside, inside, and DMZ, with rules allowing inbound HTTPS to the DMZ and blocking DMZ-to-inside traffic.
   • CSingle-interface firewall with the web server on the inside network and NAT for inbound HTTPS.
   • DUse a reverse proxy on the inside network and no firewall between the internet and the proxy.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a common method for inspecting encrypted traffic at a proxy or firewall?

   • ABlocking all encrypted traffic
   • BUsing TLS interception with a trusted certificate to decrypt, inspect, and re-encrypt traffic
   • CInspecting the encrypted payload without decryption
   • DUsing deep packet inspection on the ciphertext
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is merging two networks. Network A uses a routed firewall with a DMZ. Network B uses a transparent firewall. The merged network must support a shared web application in the DMZ and strict segmentation between departments. Which approach is most effective?

   • AUse a transparent firewall for all segments to simplify deployment.
   • BUse only the DMZ segment and remove department segmentation.
   • CKeep both firewalls in their current modes and connect them in series.
   • DStandardize on a routed firewall with multiple interfaces for the DMZ and department segments.
   Reveal Solution Discussion Select an answer first