Perimeter Protection Devices GMON Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When configuring a firewall rule to allow inbound HTTPS traffic to a web server, which combination of parameters is the most specific and appropriate for the rule?

   • AAllow all traffic from any source to the web server's IP address
   • BAllow TCP port 80 from any source to the web server's IP address
   • CAllow TCP port 443 from any source to the web server's IP address
   • DAllow UDP port 443 from any source to any destination
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which perimeter protection device is primarily used to enforce security policies by allowing or denying traffic based on source and destination IP addresses, ports, and protocols?

   • AIntrusion detection system (IDS)
   • BFirewall
   • CSecurity information and event management (SIEM) system
   • DNetwork access control (NAC) system
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   After a perimeter IPS blocks an ongoing attack, what is an appropriate remediation action to prevent the same attack from succeeding in the future?

   • AReboot the IPS device
   • BIncrease the IPS logging level to maximum and do nothing else
   • CDisable the IPS to avoid false positives
   • DUpdate the IPS signature database and verify the rule that blocked the attack is still active
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is considering replacing its existing perimeter firewall with a next-generation firewall (NGFW). The company's main requirements are to improve visibility into application usage and to enforce policies based on user identity. The current firewall only performs stateful packet filtering. Which additional capability of the NGFW is MOST critical to meeting these requirements?

   • AVirtual private network (VPN) support, which allows remote users to securely connect to the network.
   • BHigh availability (HA) support, which ensures the firewall remains operational in case of a failure.
   • CApplication identification and control, which allows the firewall to identify and block specific applications regardless of port.
   • DIntrusion prevention system (IPS) functionality, which can detect and block known exploits.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is reviewing logs from a network intrusion prevention system (IPS) and notices that the device has been dropping a high volume of traffic flagged as 'SQL Injection Attempt' from a single external IP address. The drops have been occurring for the past 30 minutes. The analyst checks the IPS dashboard and sees the device CPU is at 85% and the packet drop rate is 12%. What is the most appropriate immediate action for the analyst to take?

   • ACheck the IPS signature database version and update it if it is outdated, then continue to monitor the traffic.
   • BIncrease the IPS inspection depth to ensure all packets from the source are fully analyzed before being dropped.
   • CAdd the external IP address to a temporary block list on the perimeter firewall to stop the traffic from reaching the IPS.
   • DReboot the IPS to clear the packet drop counter and reset the device's performance statistics.
   Reveal Solution Discussion Select an answer first