Perimeter Protection Devices GMON Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst receives an alert from the network access control (NAC) system that a device on the guest Wi-Fi network is attempting to scan the internal corporate network. The NAC has already quarantined the device. What is the next most appropriate step in the response and remediation process?

   • ADisconnect the guest Wi-Fi network from the internet to prevent the device from communicating externally.
   • BInvestigate the source of the scanning activity by reviewing the NAC logs and the device's connection history to determine if it is a compromised device or a misconfigured legitimate device.
   • CImmediately block the device's MAC address at the perimeter firewall to prevent any further communication.
   • DReconfigure the NAC policy to automatically block any device that performs a network scan.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of enabling logging on a perimeter firewall?

   • ATo replace the need for an intrusion detection system
   • BTo automatically block all malicious traffic without human intervention
   • CTo record traffic and rule matches for security monitoring and incident investigation
   • DTo increase the firewall's throughput and performance
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network operations team is monitoring the health of a next-generation firewall (NGFW) that handles all traffic between the corporate network and the internet. They have set up SNMP monitoring and are receiving alerts. Which metric, if observed over a sustained period, would MOST likely indicate that the firewall is becoming a bottleneck and needs an upgrade?

   • AThe number of firewall rule hits has increased by 5% over the last month.
   • BThe firewall's session table is consistently at 80% of its maximum capacity.
   • CThe firewall's log server is receiving 10,000 events per second.
   • DThe firewall's configuration was last backed up 30 days ago.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A network operations team is monitoring a firewall that is critical to the business. The firewall has been experiencing intermittent high CPU usage and occasional packet drops. The team has noticed that the high CPU usage correlates with periods of high traffic volume. They are considering two options: (1) upgrade the firewall hardware to a more powerful model, or (2) optimize the firewall rule base by consolidating rules and removing unused rules. Which option is the MOST appropriate FIRST step to address the issue?

   • AIncrease the firewall's logging level to capture more data about the packet drops.
   • BOptimize the firewall rule base first, as this is a lower-cost and less disruptive action that may resolve the issue without a hardware upgrade.
   • CReboot the firewall to clear the packet drop counter and reset the CPU usage.
   • DUpgrade the firewall hardware immediately to ensure it can handle the peak traffic volume.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A small business wants to protect its internal network from internet-based threats. They have a limited budget and a small IT team. They need a device that can perform stateful packet inspection, block malicious traffic based on signatures, and also provide VPN termination for remote employees. Which single perimeter device would best meet all of these requirements?

   • AA layer 3 switch with access control lists (ACLs) configured to filter traffic.
   • BA next-generation firewall (NGFW) with integrated intrusion prevention and VPN capabilities.
   • CA dedicated intrusion prevention system (IPS) appliance placed inline with the internet connection.
   • DA network access control (NAC) appliance that authenticates users before granting network access.
   Reveal Solution Discussion Select an answer first