Network Security and Architecture GISF Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is designing a network for a new branch office. The security team wants to implement defense in depth, but the budget is limited. The office has 50 employees and one server room. Which combination of controls provides the most effective defense in depth within a reasonable budget?

   • AA stateful firewall at the internet edge, a host-based firewall on all workstations, and network segmentation separating the server room from user workstations.
   • BA single next-generation firewall at the internet edge with no internal segmentation.
   • CAn intrusion prevention system (IPS) at the internet edge and no other controls.
   • DNetwork segmentation only, with no firewall at the internet edge.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company's network is experiencing intermittent connectivity issues. The security team suspects an ARP spoofing attack on the LAN. They want to confirm the attack and prevent it without disrupting network operations. Which combination of actions is most appropriate?

   • AUse a packet analyzer to check for duplicate or unusual ARP replies, and enable Dynamic ARP Inspection (DAI) on the switches.
   • BDeploy an IPS that blocks all ARP packets.
   • CChange all devices to use static ARP entries.
   • DBlock all ARP traffic on the network.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is developing a network security policy. The security team wants to ensure that network monitoring is performed, but they also need to respect employee privacy and comply with local regulations. Which policy element should the team include?

   • AA monitoring and privacy policy that clearly states what data is collected, who can access it, and how it is used, with employee acknowledgment.
   • BAn acceptable use policy that prohibits personal use of the network.
   • CA change management procedure that requires approval for all network changes.
   • DAn incident response plan that includes steps for notifying law enforcement.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company is deploying a wireless network in a high-security area. The requirement is to ensure that only authorized devices can connect, and that wireless traffic is protected from eavesdropping. The company also wants to detect any rogue access points. Which combination of measures best meets these requirements?

   • AWPA3-Personal with a shared passphrase and hidden SSID.
   • BOpen network with a captive portal for authentication.
   • CWPA3-Enterprise with 802.1X authentication, and a wireless intrusion prevention system (WIPS) to monitor for rogue APs.
   • DWPA2-PSK with a long passphrase and MAC address filtering.
   Reveal Solution Discussion Select an answer first
6. 40application · easy

   An organization is updating its network security policies. The goal is to ensure that changes to firewall rules are reviewed and approved before implementation, and that unauthorized changes are prevented. Which policy component should be included?

   • AAn incident response policy that defines steps for responding to security incidents.
   • BAn acceptable use policy that restricts employee internet usage.
   • CA password policy that requires complex passwords for network devices.
   • DA change management policy that requires formal approval for all firewall rule changes and logs all changes.
   Reveal Solution Discussion Select an answer first