Perimeter Protection Devices GMON Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security operations center (SOC) is reviewing logs from a network access control (NAC) system and notices that a device that was previously quarantined for a malware infection is now back on the network and is again exhibiting the same malicious behavior. The SOC also notices that the NAC system's logs show the device was released from quarantine by an administrator. What is the most likely reason the device was released, and what should the SOC do?

   • AThe device may have been released by an administrator for a legitimate business reason, so the SOC should not take any action and continue monitoring.
   • BThe NAC system may have failed to detect the malware initially, so the SOC should update the NAC system's malware signatures.
   • CThe NAC system may have a bug that is causing it to release devices from quarantine, so the SOC should update the NAC system's software.
   • DThe administrator may have released the device prematurely without ensuring it was fully remediated, so the SOC should re-quarantine the device and ensure proper remediation before allowing it back on the network.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is configuring a firewall to protect a web application. The application is a critical business system, and the team wants to ensure high availability. They are considering two configurations: (1) a single firewall with a rule that allows all traffic from the application's load balancer IP, or (2) a pair of firewalls in an active-passive high-availability cluster with a rule that allows traffic from the load balancer IP and also includes a rule to log all traffic from the load balancer. Which configuration is more resilient and provides better monitoring?

   • AConfiguration 1 is more resilient because it is simpler and has fewer components that can fail.
   • BBoth configurations are equally resilient and provide the same level of monitoring.
   • CConfiguration 1 provides better monitoring because it allows all traffic from the load balancer, so no traffic is dropped.
   • DConfiguration 2 is more resilient and provides better monitoring because it eliminates the firewall as a single point of failure and provides logging for all traffic from the load balancer.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large organization is redesigning its network. They have a critical application that must be accessible to employees both from the internal network and from the internet via VPN. The application also needs to be isolated from the general internal network due to compliance requirements. The security team is considering two architectures: (1) placing the application in a DMZ with firewalls on both sides, or (2) placing the application on a separate VLAN with a firewall between the VLAN and the internal network, and a VPN concentrator in the DMZ. Which architecture is MORE secure and why?

   • AArchitecture 2 (VLAN with a single firewall) is more secure because it reduces the number of firewalls and simplifies management, reducing the risk of misconfiguration.
   • BBoth architectures are equally secure because they both use firewalls to isolate the application.
   • CArchitecture 2 is more secure because the VPN concentrator in the DMZ can inspect all traffic before it reaches the application.
   • DArchitecture 1 (DMZ with firewalls on both sides) is more secure because it provides a clear security boundary and allows for different security policies for internet-facing and internal-facing traffic.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An intrusion prevention system (IPS) has detected and blocked a series of exploit attempts against a public-facing web server. The attacks are coming from multiple different IP addresses, but they all use the same exploit signature. The IPS has blocked the individual attacks, but the attempts are continuing. What is the most effective next step to mitigate this ongoing threat?

   • AIncrease the IPS sensitivity level to catch more variations of the exploit.
   • BDisable the IPS signature that is triggering the alerts to reduce false positives.
   • CCreate a firewall rule to block all traffic from the specific IP addresses that have been identified.
   • DApply a virtual patch on the IPS to block the specific exploit signature for the affected web server.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A security team wants to be notified when a perimeter IPS device becomes unresponsive or fails. Which monitoring method is best suited for this purpose?

   • AManually checking the device console daily
   • BSNMP traps and heartbeat monitoring
   • CAnalyzing network traffic captures
   • DReviewing firewall logs weekly
   Reveal Solution Discussion Select an answer first