CND Network Perimeter Protection — Timed 10 Questions

Question 1

An administrator implementing Suricata as an IDS/IPS needs to enable offline analysis of a stored PCAP file containing suspicious network captures. Which command-line switch should be used to read from a PCAP file?

10 minute time limit — choose an answer to begin.

Accepted Answer

suricata -r suspect_traffic.pcap. Suricata uses the -r switch to read packets from a PCAP file.

Answer

suricata -T

Answer

suricata --daemon

Question 2

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

Accepted Answer

ufw allow from 192.168.100.0/24 to any port 22 proto tcp. The ufw allow command accepts rules specifying source subnets and ports.

Answer

ufw enable 192.168.100.0/24

Answer

ufw deny ssh

Answer

ufw route allow 22

Question 3

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

Accepted Answer

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT. Using the connection tracking module (-m conntrack --ctstate ESTABLISHED,RELATED) combined with the -j ACCEPT target allows return traffic for active outbound sessions.

Answer

iptables -A INPUT -m limit --limit 5/min -j LOG

Answer

iptables -A FORWARD -p tcp --dport 80 -j REJECT

Answer

iptables -A INPUT -m state --state NEW -j DROP

Question 4

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

Accepted Answer

External Firewall inspects and restricts traffic from internet to DMZ; Internal Firewall restricts traffic from DMZ to internal network to only required service ports.. In a dual-firewall DMZ, the external firewall filters traffic from the internet to the DMZ, and the internal firewall strictly controls traffic between the DMZ and the internal network.

Answer

External Firewall acts as a transparent bridge; Internal Firewall performs NAT for all internet-bound traffic.

Answer

External Firewall routes internal traffic; Internal Firewall acts as a honeypot gateway.

Answer

External Firewall permits all traffic to DMZ; Internal Firewall blocks all traffic from DMZ to internal network.

Question 5

An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?

Accepted Answer

alert tcp any any -> any 80 (msg:"Directory Traversal Attempt"; content:"../../etc/passwd"; sid:1000001; rev:1;). Snort rules require an action (alert), protocol (tcp), source/destination IPs and ports, and payload options (content).

Answer

log icmp any any -> any any (msg:"ICMP Ping Detected"; itype:8; sid:1000003;)

Answer

drop udp external any -> $HOME_NET 53 (content:"passwd"; sid:1000002;)

Answer

pass ip any any -> any any (content:"GET /index.html"; sid:1000004;)

Question 6

An administrator is configuring a Cisco ASA firewall and needs to allow internal users to initiate outbound HTTP/HTTPS sessions while ensuring that return traffic is permitted through the stateful inspection engine without opening explicit inbound rules. Which object-group and access-list construct properly permits outbound web traffic?

Accepted Answer

access-list INSIDE_IN extended permit tcp any any eq www and access-list INSIDE_IN extended permit tcp any any eq 443, applied via access-group INSIDE_IN in interface inside. Stateful firewalls automatically track outbound connections, so allowing outbound traffic on ports 80 and 443 via an access-list applied to the inside interface is sufficient.

Answer

access-list OUTBOUND extended permit tcp any any eq 80 and access-group OUTBOUND in interface outside

Answer

static (inside,outside) tcp interface 80 192.168.1.10 80 netmask 255.255.255.255

Answer

object network WEB_PORTS; range 80 443; nat (inside,outside) dynamic interface

Question 7

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

Accepted Answer

SSL/TLS Decryption (Inspection). SSL/TLS Decryption (or Inbound/Outbound Inspection) allows the NGFW to decrypt traffic, inspect it for threats, and re-encrypt it.

Answer

Layer 2 Bridging

Answer

Port Forwarding

Answer

Static NAT

Question 8

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

Accepted Answer

Honeypot. A honeypot is a decoy system designed to attract and trap attackers.

Answer

Intrusion Prevention System

Answer

Stateful Inspection Firewall

Answer

Proxy Server

Question 9

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

Accepted Answer

Demilitarized Zone (DMZ). A Demilitarized Zone (DMZ) isolates public-facing services from the internal network.

Answer

Internal LAN

Answer

Management VLAN

Answer

Virtual Private Network (VPN) pool

Question 10

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

Accepted Answer

Control Plane Policing (CoPP). Control Plane Policing (CoPP) or Control Plane Protection protects the router CPU by policing management and control traffic.

Answer

Spanning Tree Root Guard

Answer

Port Security

Answer

Dynamic ARP Inspection (DAI)