An administrator is configuring a Cisco ASA firewall and needs to allow internal users to initiate outbound HTTP/HTTPS sessions while ensuring that return traffic is permitted through the stateful inspection engine without opening explicit inbound rules. Which object-group and access-list construct properly permits outbound web traffic?
An administrator implementing Suricata as an IDS/IPS needs to enable offline analysis of a stored PCAP file containing suspicious network captures. Which command-line switch should be used to read from a PCAP file?
An organization wants to deploy a low-interaction honeypot that mimics common vulnerable network services (like SSH, Telnet, and FTP) to quickly log unauthorized login attempts and brute-force attacks. Which open-source tool is best suited for this task?
An administrator is deploying a Snort 3 Intrusion Detection System on an enterprise gateway segment. To detect a specific exploit payload containing the exact ASCII string \x41\x41\x41\x41 without relying on preprocessors, which rule option should be implemented?
An enterprise perimeter firewall is experiencing a volumetric SYN flood denial-of-service attack. The network administrator wants to mitigate the attack at the firewall level without dropping legitimate client connections or modifying the internal server TCP stack configurations. Which specialized firewall feature should be activated?
An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?
A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?
A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?
An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?
A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?
A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?
An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?
A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?
An attacker performs a TCP SYN flood attack against a perimeter web server protected by a firewall. The security engineer enables SYN cookies on the firewall/router. How does this feature mitigate the attack?
Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?
An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?
A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?
An organization deploys an inline Intrusion Prevention System (IPS) that begins dropping legitimate business-critical transactions due to false positives caused by a custom application protocol. What is the most appropriate immediate action for the security team while maintaining perimeter visibility?
An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?
A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?
An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?
Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?
When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?
A security engineer is configuring a firewall to prevent IP address spoofing from the external untrusted interface. Which built-in routing/firewall feature checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface expected for that source network?
Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)
When deploying an Intrusion Prevention System (IPS) in an inline network architecture, which THREE critical operational factors must security engineers evaluate to prevent network disruption? (Choose THREE)
An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which THREE best practices should be implemented? (Choose THREE)
Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)
A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that have the SYN flag set while the FIN flag is also set, which is a common malformed packet attack vector. Which iptables command should the engineer use?
A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)
An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)
A security architect is configuring an enterprise-grade Application Layer Gateway (ALG) stateful firewall to inspect active FTP data channels. The firewall must dynamically open ephemeral ports for incoming data connections based on control channel negotiations. Which firewall configuration mechanism must be enabled to support this behavior?
An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?
A security engineer is designing a segmented network perimeter using a traditional three-tier architecture. Which zone should house public-facing web servers and mail relay servers, ensuring they are isolated from both the internal trusted LAN and the public internet via distinct firewall contexts?
Which TWO of the following characteristics accurately differentiate a Next-Generation Firewall (NGFW) from a traditional stateless or stateful inspection firewall? (Choose two)
A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?
A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)
A security engineer is deploying an inline NIPS appliance between the perimeter firewall and the internal core switch. During testing, legitimate TCP sessions from branch offices are being reset mid-transfer, and packet captures show the sensor injecting RST packets to both endpoints. Which configuration change will most directly stop the NIPS from breaking these legitimate flows?
A network security engineer is deploying a new e-commerce web farm behind an Application Delivery Controller in the screened subnet. The organization requires that inbound HTTPS sessions be terminated and re-encrypted to the backend web servers, that the ADC validate client certificates, and that the ADC block HTTP requests containing SQL injection patterns before they reach the servers. Which capability must the ADC provide to meet these requirements?
A small business wants to prevent employees from accessing known malicious websites and to log all outbound web requests for later review. The administrator has no budget for a full next-generation firewall and wants a solution that can be deployed as a transparent bridge without changing client IP configurations. Which perimeter control best fits these requirements?
A security team is reviewing perimeter firewall logs and observes that an external host is sending TCP segments with the FIN flag set but no prior SYN, and also sending TCP segments with both SYN and FIN flags set simultaneously. The firewall is stateful and currently drops these packets. Which statement best describes what the attacker is attempting and the correct defensive interpretation?
An organization is designing a perimeter architecture with two firewalls from different vendors placed in series between the internet and the internal network. A security architect argues this dual-vendor design improves defense in depth. Which statement best describes a realistic operational consideration of this design?
A network defender is hardening a perimeter firewall to resist evasion techniques that manipulate packet fragmentation and TCP options. Which TWO measures should be implemented to improve the firewall's ability to correctly reassemble and inspect fragmented traffic? (Choose two.)