Firewalls CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which firewall architecture involves a single, highly exposed host that is the primary point of contact for external connections?

   • ADemilitarized zone (DMZ)
   • BScreened subnet
   • CDual-homed host
   • DBastion host
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary goal of high availability (HA) testing for a firewall?

   • ATo ensure that the firewall rules are synchronized across all devices
   • BTo verify that the firewall logs are being backed up
   • CTo verify that a backup firewall takes over seamlessly if the primary fails
   • DTo measure the firewall's maximum throughput
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When reviewing a firewall policy, which practice is considered a security best practice?

   • APlacing the most specific rules at the bottom of the rule set
   • BDenying all traffic by default and then allowing only what is necessary
   • CAllowing all traffic by default and then blocking specific threats
   • DUsing the same rule set for all network segments
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security tester is analyzing a firewall rule set that contains the following rules in order: 1) allow tcp from any to web-server port 80; 2) allow tcp from any to web-server port 443; 3) deny tcp from any to any port 22; 4) allow tcp from any to any. The tester discovers that SSH traffic to the web server is being allowed, which is a violation of policy. Why is SSH being allowed?

   • ARule 1 allows SSH because it permits all traffic to the web server on port 80.
   • BThe deny rule is misconfigured and does not match SSH traffic.
   • CRule 4 allows all TCP traffic, including SSH, because it appears after the deny rule.
   • DRule 2 allows SSH because it permits all traffic to the web server on port 443.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing firewall logs and notices that the log volume is very low, with only a few entries per day, despite the network having high traffic. The firewall is configured to log only denied traffic. What is the most likely issue?

   • AThe firewall is failing and not logging any traffic.
   • BThe firewall is configured to log only denied traffic, which is a best practice.
   • CThe firewall logs are being overwritten quickly due to high volume.
   • DThe firewall is not logging allowed traffic, which is normal but may hide malicious activity that is allowed by rules.
   Reveal Solution Discussion Select an answer first