A company is deploying a new firewall in an active-passive high availability pair. The security team wants to ensure that if the active firewall fails, the passive firewall takes over without dropping existing connections. Which feature must be configured to achieve this?

A heartbeat link between the firewalls.

Load balancing across both firewalls.

A virtual IP address for the firewall pair.

State synchronization between the firewalls.

What is the primary goal of firewall bypass techniques such as tunneling and protocol evasion?

To improve the firewall's logging capabilities

To hide malicious traffic from firewall inspection

To make the firewall process traffic faster

To reduce the number of firewall rules

What is the primary purpose of regularly reviewing firewall policies?

To increase the number of rules to improve security

To verify that the rules still align with current security requirements and business needs

To replace the firewall with a newer model

To ensure the firewall hardware is functioning correctly

A security tester is assessing a firewall that is configured to allow outbound HTTP and HTTPS. The tester wants to test if the firewall can be bypassed using protocol evasion. Which technique is most likely to succeed?

Send HTTP requests with unusual encoding, such as chunked transfer encoding or obfuscated URLs.

Use a different protocol, such as FTP, on port 80.

Use a non-standard port, such as TCP 8080, for HTTP traffic.

Use a VPN to encrypt all traffic and send it to a VPN server.

A security tester is reviewing a firewall policy for a small business. The policy includes the following rules: 1) allow tcp from any to any port 80; 2) allow tcp from any to any port 443; 3) allow udp from any to any port 53; 4) deny ip from any to any. The business only runs a public web server and needs DNS resolution for outbound traffic. Which rule is a potential security risk?

Rule 4 denies all traffic, which is a good default deny rule.

Rule 3 allows outbound DNS to any destination, which is necessary for resolution.

Rule 2 allows inbound HTTPS traffic to any destination, which is acceptable because HTTPS is secure.

Rule 1 allows inbound HTTP traffic to any destination, not just the web server.

Certified Tester Security Tester

Domain 5Objective 4

Firewalls CT-SEC Practice Questions (Page 2)

Part of the Testing Security Mechanisms domain, which makes up ~17% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 1–2 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

8concepts

Questions 6–10

6application · medium
A company is deploying a new firewall in an active-passive high availability pair. The security team wants to ensure that if the active firewall fails, the passive firewall takes over without dropping existing connections. Which feature must be configured to achieve this?
Select an answer first
7foundation · easy
What is the primary goal of firewall bypass techniques such as tunneling and protocol evasion?
Select an answer first
8foundation · easy
What is the primary purpose of regularly reviewing firewall policies?
Select an answer first
9expert · hard
A security tester is assessing a firewall that is configured to allow outbound HTTP and HTTPS. The tester wants to test if the firewall can be bypassed using protocol evasion. Which technique is most likely to succeed?
Select an answer first
10application · medium
A security tester is reviewing a firewall policy for a small business. The policy includes the following rules: 1) allow tcp from any to any port 80; 2) allow tcp from any to any port 443; 3) allow udp from any to any port 53; 4) deny ip from any to any. The business only runs a public web server and needs DNS resolution for outbound traffic. Which rule is a potential security risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.