Perimeter Protection Devices GMON Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is responding to an alert from an intrusion prevention system (IPS) indicating that a host on the internal network is communicating with a known command-and-control (C2) server. The IPS has blocked the communication. The analyst needs to determine the scope of the infection. Which action is the MOST appropriate next step?

   • AChange the firewall rules to block all traffic to the C2 server IP address.
   • BReview the IPS logs to identify all other internal hosts that have communicated with the same C2 server IP address.
   • CRebuild the infected host from a known good image to ensure it is clean.
   • DImmediately disconnect the infected host from the network to prevent further communication.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturing company is deploying a new SCADA network segment for its robotic assembly line. The segment must be isolated from the corporate IT network, but the engineering team needs to push firmware updates to the robots from a management workstation in the IT network. The security team wants to enforce that only the specific management workstation can initiate connections to the robots, and no robot can initiate connections back to the IT network. Which perimeter device placement and configuration best meets these requirements?

   • APlace a stateful firewall between the IT and SCADA networks, configured with an inbound allow rule for the management workstation's IP to the robots' IPs on the firmware-update port, and a default deny rule for all other traffic.
   • BDeploy a network access control solution on the SCADA network that authenticates the management workstation before it can reach the robots.
   • CInstall an intrusion prevention system inline between the IT and SCADA networks and configure a signature to allow the management workstation's firmware update traffic.
   • DConnect the SCADA network to a dedicated switch port on the IT core switch and configure a VLAN with an access control list that permits the management workstation's traffic to the robots.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network team is responsible for maintaining a firewall that handles all traffic between the corporate network and the internet. They want to proactively identify potential performance issues before they impact users. Which metric should they monitor most closely to detect an impending capacity problem?

   • AThe number of logged events, as a high number of events can indicate the firewall is processing a lot of traffic and may be nearing capacity.
   • BThe firewall's uptime, as a long uptime can indicate the device is stable and less likely to have performance issues.
   • CThe firewall's CPU utilization, as sustained high usage can indicate the device is struggling to process traffic and may soon drop packets.
   • DThe number of active firewall rules, as a high number of rules can slow down traffic processing and indicate a need for rule cleanup.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company's security policy requires that all outbound web traffic from the internal network must pass through a proxy server for content filtering and logging. The proxy server is located in a DMZ. The firewall currently has a rule that allows all outbound traffic from the internal network to any destination. What is the most secure way to reconfigure the firewall rule to enforce this policy?

   • AKeep the existing rule but add a logging rule to capture all outbound traffic to the proxy server.
   • BCreate a rule that blocks all outbound traffic from the internal network to the internet, and then create a separate rule that allows traffic from the proxy server to the internet.
   • CChange the existing rule to allow outbound traffic only to the proxy server's IP address on port 8080, and create a second rule to allow the proxy server to forward traffic to the internet.
   • DConfigure the firewall to perform deep packet inspection on all outbound traffic and block any traffic that does not match the proxy server's user-agent string.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which metric is most important to monitor on a perimeter firewall to ensure it can handle current traffic without dropping packets?

   • AUptime of the device
   • BFirmware version
   • CNumber of firewall rules configured
   • DCPU utilization and interface throughput
   Reveal Solution Discussion Select an answer first