CND Network Perimeter Protection — 10 Questions

Question 1

An administrator is configuring a Cisco ASA firewall and needs to allow internal users to initiate outbound HTTP/HTTPS sessions while ensuring that return traffic is permitted through the stateful inspection engine without opening explicit inbound rules. Which object-group and access-list construct properly permits outbound web traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

access-list INSIDE_IN extended permit tcp any any eq www and access-list INSIDE_IN extended permit tcp any any eq 443, applied via access-group INSIDE_IN in interface inside. The correct construct is an access-list applied inbound on the inside interface that permits TCP traffic to any destination on ports 80 (www) and 443. Because the ASA is stateful, return traffic is automatically allowed without an explicit inbound rule on the outside interface.

Answer

access-list OUTBOUND extended permit tcp any any eq 80 and access-group OUTBOUND in interface outside

Answer

static (inside,outside) tcp interface 80 192.168.1.10 80 netmask 255.255.255.255

Answer

object network WEB_PORTS; range 80 443; nat (inside,outside) dynamic interface

Question 2

An administrator implementing Suricata as an IDS/IPS needs to enable offline analysis of a stored PCAP file containing suspicious network captures. Which command-line switch should be used to read from a PCAP file?

Accepted Answer

suricata -r suspect_traffic.pcap. Suricata uses the -r switch to read packets from a PCAP file.

Answer

suricata -T

Answer

suricata --daemon

Question 3

An organization wants to deploy a low-interaction honeypot that mimics common vulnerable network services (like SSH, Telnet, and FTP) to quickly log unauthorized login attempts and brute-force attacks. Which open-source tool is best suited for this task?

Accepted Answer

Cowrie. Cowrie is a medium-to-low interaction SSH and Telnet honeypot designed to log brute-force attacks and shell interactions. It emulates a vulnerable system, captures login attempts, and records attacker commands in a controlled environment. It is open-source and specifically built for the task of mimicking SSH, Telnet, and FTP services to gather threat intelligence.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 4

An administrator is deploying a Snort 3 Intrusion Detection System on an enterprise gateway segment. To detect a specific exploit payload containing the exact ASCII string \x41\x41\x41\x41 without relying on preprocessors, which rule option should be implemented?

Accepted Answer

content:"|41 41 41 41|";. In Snort 3 (and Snort 2), the content option is the correct keyword for matching a literal byte pattern in the packet payload, and hexadecimal bytes are specified inside pipes: content:"|41 41 41 41|";. This matches the exact ASCII string 'AAAA' (0x41 is 'A') without relying on preprocessors, which is exactly what the question requires. The content option is the fundamental payload inspection keyword in Snort rule syntax.

Answer

pattern:"AAAA";

Answer

search:"AAAA";

Answer

payload_match:"\x41\x41\x41\x41";

Question 5

An enterprise perimeter firewall is experiencing a volumetric SYN flood denial-of-service attack. The network administrator wants to mitigate the attack at the firewall level without dropping legitimate client connections or modifying the internal server TCP stack configurations. Which specialized firewall feature should be activated?

Accepted Answer

SYN Cookies. SYN cookies are the specialized firewall feature that mitigates SYN floods without dropping legitimate connections or altering server TCP stacks. When the SYN queue is under pressure, the firewall responds to each SYN with a SYN-ACK containing a cryptographic cookie as the sequence number, and only allocates state when the client returns the ACK, validating the handshake.

Answer

TCP Selective Acknowledgments (SACK)

Answer

TCP Window Scaling

Answer

Reverse Path Forwarding (RPF) strict mode

Question 6

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

Accepted Answer

ufw allow from 192.168.100.0/24 to any port 22 proto tcp. The correct UFW syntax to allow SSH from a specific subnet is `ufw allow from 192.168.100.0/24 to any port 22 proto tcp`. This rule specifies the source subnet, the destination (any), the port (22), and the protocol (TCP), which is exactly what UFW expects for a scoped allow rule.

Answer

ufw enable 192.168.100.0/24

Answer

ufw deny ssh

Answer

ufw route allow 22

Question 7

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

Accepted Answer

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT. The conntrack match extension with --ctstate ESTABLISHED,RELATED tells iptables to accept packets that belong to connections already tracked by the kernel's connection-tracking subsystem, or that are related to such connections (e.g., FTP data channels, ICMP errors). Placing this rule early in the INPUT chain ensures return traffic for outbound-initiated sessions is permitted without re-evaluating later rules, which is the canonical stateful-firewall pattern.

Answer

iptables -A INPUT -m limit --limit 5/min -j LOG

Answer

iptables -A FORWARD -p tcp --dport 80 -j REJECT

Answer

iptables -A INPUT -m state --state NEW -j DROP

Question 8

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

Accepted Answer

External Firewall inspects and restricts traffic from internet to DMZ; Internal Firewall restricts traffic from DMZ to internal network to only required service ports.. In a dual-firewall DMZ architecture, the external firewall should inspect and restrict traffic from the internet to the DMZ, while the internal firewall should restrict traffic from the DMZ to the internal network to only required service ports. This implements defense-in-depth: the external firewall protects the DMZ from internet threats, and the internal firewall prevents a compromised DMZ host from pivoting into the internal network. This segmentation is a security best practice.

Answer

External Firewall acts as a transparent bridge; Internal Firewall performs NAT for all internet-bound traffic.

Answer

External Firewall routes internal traffic; Internal Firewall acts as a honeypot gateway.

Answer

External Firewall permits all traffic to DMZ; Internal Firewall blocks all traffic from DMZ to internal network.

Question 9

An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?

Accepted Answer

alert tcp any any -> any 80 (msg:"Directory Traversal Attempt"; content:"../../etc/passwd"; sid:1000001; rev:1;). The correct Snort rule must match TCP traffic destined to port 80 (HTTP) and inspect the payload for the directory traversal string. Option C uses the proper header 'alert tcp any any -> any 80' with a content match on '../../etc/passwd', which is exactly the signature required to detect this attack. The 'sid' and 'rev' fields provide unique identification and revision tracking, completing a valid Snort rule.

Answer

log icmp any any -> any any (msg:"ICMP Ping Detected"; itype:8; sid:1000003;)

Answer

drop udp external any -> $HOME_NET 53 (content:"passwd"; sid:1000002;)

Answer

pass ip any any -> any any (content:"GET /index.html"; sid:1000004;)

Question 10

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

Accepted Answer

SSL/TLS Decryption (Inspection). SSL/TLS Decryption (Inspection) is the feature that allows an NGFW to decrypt encrypted traffic, inspect the plaintext payload against DPI signatures, and then re-encrypt it before forwarding. Without this, HTTPS traffic remains encrypted and DPI cannot see inside, so malicious payloads bypass detection. This is essential for enforcing security policies on encrypted sessions.

Answer

Layer 2 Bridging

Answer

Port Forwarding

Answer

Static NAT