Perimeter Protection Devices GMON Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A firewall alert indicates that a workstation on the internal network is communicating with a known malicious command-and-control server. What is the FIRST step in the response process?

   • ADelete the firewall logs to free up storage
   • BRebuild the workstation from a known good image
   • CIgnore the alert because the firewall blocked the traffic
   • DContain the threat by isolating the affected workstation from the network
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is responding to an alert from a firewall indicating that a user's workstation is communicating with a known malicious IP address. The analyst has confirmed the alert is accurate. The workstation is used by a senior executive who is currently in an important meeting and cannot be disturbed. What is the most appropriate response action?

   • AIgnore the alert for now and continue monitoring the workstation's traffic to gather more information.
   • BIsolate the workstation from the network immediately to prevent further communication with the malicious IP, and then investigate.
   • CBlock the workstation's communication with the malicious IP at the firewall, and then investigate the workstation's activity without disrupting the user.
   • DShut down the workstation to stop all communication, and then perform a forensic analysis.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is implementing a policy that only allows company-issued laptops to connect to the corporate network. They want to ensure that any unauthorized device that tries to connect is blocked and logged. Which perimeter protection device is BEST suited for this task?

   • AAn intrusion prevention system (IPS) that blocks traffic from known malicious IP addresses.
   • BA network access control (NAC) solution that authenticates devices and enforces compliance before granting network access.
   • CA layer 2 switch with port security configured to limit the number of MAC addresses per port.
   • DA next-generation firewall (NGFW) with application-level inspection.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A firewall administrator is configuring rules on a firewall that handles traffic for a large organization. The organization has a policy that requires all traffic to be logged, but the firewall's logging capability is limited and cannot handle the volume of logs generated by all traffic. The administrator needs to ensure that all traffic is logged while minimizing the impact on the firewall's performance. Which approach is most effective?

   • AConfigure the firewall to send logs to an external log management system using a high-speed interface, and enable logging for all traffic.
   • BEnable logging for all traffic, but configure the firewall to drop packets that exceed a certain rate to reduce the log volume.
   • CEnable logging for all traffic and store logs locally on the firewall, but increase the firewall's storage capacity to handle the log volume.
   • DEnable logging for all traffic, but configure the firewall to compress the logs before storing them locally.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A network operations team is monitoring the health of a firewall that is critical to the organization's security. They have noticed that the firewall's memory utilization has been steadily increasing over the past few weeks, and they are concerned about a potential outage. They have also noticed that the firewall's log files are growing rapidly. What is the most likely cause of the memory increase, and what should the team do to address it?

   • AThe firewall is under a denial-of-service attack, so the team should block the attacking IP addresses to reduce the memory usage.
   • BThe firewall's log files are consuming memory, so the team should configure log rotation and offload logs to an external server to free up memory.
   • CThe firewall's rulebase is too large, so the team should remove unused rules to reduce the memory footprint.
   • DThe firewall is experiencing a memory leak in its software, so the team should reboot the firewall to clear the memory and then monitor it.
   Reveal Solution Discussion Select an answer first