Network Security and Architecture GISF Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which secure design principle restricts users and processes to only the minimum permissions necessary to perform their tasks?

   • ADefense in depth
   • BLeast privilege
   • CSegmentation
   • DRedundancy
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security policy requires that all network traffic between two branch offices be protected from eavesdropping and tampering. The traffic traverses the internet. Which solution should be implemented?

   • AA dedicated leased line
   • BA site-to-site VPN using IPsec
   • CA firewall rule that allows all traffic between the two offices
   • DA network monitoring tool to detect eavesdropping
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which TCP/IP layer corresponds most closely to the combination of the OSI model's Session, Presentation, and Application layers?

   • ATransport layer
   • BNetwork Interface layer
   • CInternet layer
   • DApplication layer
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is implementing network access control (NAC) for both wired and wireless networks. The security team wants to ensure that only company-managed devices can access the network, but they also need to allow guests to access the internet only. The company uses Active Directory for authentication. Which approach best meets both requirements?

   • AUse 802.1X with machine authentication for company devices, and provide a separate guest SSID/VLAN with internet-only access.
   • BImplement MAC address filtering for all devices and manually add guest devices.
   • CUse a shared password for all devices and rely on the firewall to block guests from internal resources.
   • DUse a single SSID with WPA2-Enterprise and require users to authenticate with their personal credentials.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is investigating a potential data exfiltration. The logs show that an internal server made a large outbound transfer to an external IP address on port 443. The transfer occurred during off-hours and the server is not supposed to initiate outbound connections. However, the server is also used for legitimate HTTPS updates. Which action should the analyst take to determine if this is malicious?

   • ADisable the server's network interface to prevent further data transfer.
   • BCheck the server's DNS cache and process list to identify which process initiated the connection and whether the destination domain is known.
   • CIgnore the traffic because port 443 is commonly used for legitimate HTTPS.
   • DBlock the external IP address immediately to stop the potential exfiltration.
   Reveal Solution Discussion Select an answer first