Perimeter Protection Devices GMON Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   A security policy requires that all outbound DNS queries from internal clients be allowed, but all other outbound UDP traffic should be blocked. Which firewall rule set correctly implements this policy?

   • ADeny all outbound UDP traffic, then allow outbound UDP port 53
   • BAllow outbound TCP port 53, then deny all other outbound TCP traffic
   • CAllow outbound UDP port 53 to the DNS server, then deny all other outbound UDP traffic
   • DAllow all outbound UDP traffic, then deny port 53
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company is deploying a new application that will be accessed by both internal employees and external partners. The application must be isolated from the internal network, but the external partners need to access it directly. The security team is considering two architectures: (1) placing the application in a DMZ with a firewall between the DMZ and the internal network, and (2) placing the application in a DMZ with a firewall between the internet and the DMZ. Which architecture is more appropriate for this scenario, and why?

   • ABoth architectures are equally appropriate because they both use a firewall to protect the DMZ.
   • BArchitecture 2 is more appropriate because it protects the application from internet-based threats.
   • CArchitecture 1 is more appropriate because it protects the internal network from the application, which is important since the application is accessed by external partners.
   • DNeither architecture is appropriate because the application should be placed on the internal network to allow both internal and external access.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A network administrator is monitoring the performance of a firewall and notices that the average CPU utilization has been steadily increasing over the past few weeks. The administrator also notices an increase in the number of dropped packets. Which action should the administrator take FIRST to investigate the cause?

   • AReview the firewall's traffic logs to identify any new or unusual traffic patterns that may be causing the increased load.
   • BIncrease the firewall's logging level to capture more detailed information about the dropped packets.
   • CImmediately reboot the firewall to clear the packet drop counter and reset the CPU usage.
   • DCheck the firewall's routing table to ensure that routes are correctly configured.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst receives an alert from the network access control (NAC) system indicating that a device on the corporate network is exhibiting behavior consistent with a malware infection, such as scanning other hosts on the network. The analyst needs to respond quickly to prevent the spread of the infection. What is the most immediate containment action the analyst should take?

   • ABlock the device's MAC address at the core switch to prevent it from communicating with other hosts.
   • BShut down the device remotely to stop the malicious activity, then begin a forensic investigation on the device.
   • CUse the NAC system to quarantine the device from the network, isolating it from other hosts while preserving the ability to investigate it.
   • DIgnore the alert for now and monitor the device's behavior to confirm it is actually infected before taking any action.
   Reveal Solution Discussion Select an answer first