Network Proxies and Firewalls GDSA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which firewall rule design practice best supports the principle of least privilege?

   • AUsing specific rules that define source, destination, port, and protocol for each allowed service
   • BCreating rules that allow traffic from any source to any destination on common ports
   • CPlacing a broad 'allow all' rule at the top of the rule base
   • DRelying on the firewall's default rules without customization
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security team is investigating a breach that involved an internal user accessing a malicious website. The proxy logs show the user's IP and the URL, but the team needs to identify the specific user and the content of the HTTPS request. Which additional logging or configuration would provide the most useful evidence?

   • AEnable DNS logging on the internal DNS server.
   • BEnable NetFlow on the core switch.
   • CEnable firewall logging for all connections.
   • DEnable proxy authentication and SSL inspection logging.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An incident responder needs to investigate a suspected data exfiltration via HTTPS. The organization uses a forward proxy that terminates TLS. Which logging/inspection capability is most essential to see the actual content of the HTTPS sessions?

   • AUse a packet capture on the firewall without TLS interception.
   • BEnable TLS interception and log decrypted traffic metadata and content.
   • CLog only the source/destination IPs and ports of the HTTPS connections.
   • DEnable stateful inspection on the firewall to log all HTTP methods.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Why is logging of proxy and firewall traffic important for incident response?

   • ALogs provide a record of network activity that can be analyzed to identify the source and scope of an incident
   • BLogs automatically block malicious traffic
   • CLogs replace the need for intrusion detection systems
   • DLogs are required by law for all network traffic
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security architect is designing a defense-in-depth strategy. They have a firewall that performs stateful inspection and a proxy that performs URL filtering. They want to add a control that can detect and block malware that evades both the firewall and the proxy by using encrypted tunnels. Which control would be most effective?

   • ADeploy an intrusion prevention system (IPS) with SSL inspection capabilities.
   • BAdd more URL filtering categories to the proxy.
   • CEnable logging on the firewall to capture all traffic.
   • DDeploy a network access control (NAC) solution.
   Reveal Solution Discussion Select an answer first