A security analyst is troubleshooting an IPsec site-to-site VPN tunnel failure on a Linux-based StrongSwan gateway. The logs indicate an 'ESP packet decryption failed' error. Upon reviewing the security association parameters, the analyst notices a mismatch in the cryptographic checksum algorithm. Which IPsec protocol component is responsible for providing data integrity and authentication for the inner packet?
An organization is configuring an IPsec VPN tunnel between two branch offices using Cisco IOS routers. The engineering team requires the use of a secure key exchange method that provides perfect forward secrecy (PFS) during the Phase 1 Internet Key Exchange (IKEv1) negotiation. Which Phase 1 mode must be selected?
A security engineer is configuring a stateful inspection firewall and needs to handle incoming traffic for an active FTP data connection operating in passive mode. What specific challenge does passive FTP present to the firewall, and how does the firewall resolve it?
A company is implementing a next-generation firewall (NGFW) and wants to inspect encrypted HTTPS traffic traversing the network without triggering browser certificate warning errors on corporate-managed endpoints. Which deployment method achieves this?
A security administrator is hardening a network switch against VLAN hopping attacks. Which two configuration steps must be implemented on all user-facing access ports to neutralize this threat?
A network security analyst is reviewing NetFlow records and notices an unusually high volume of small UDP packets originating from a single internal host destined to various random external IP addresses on ephemeral ports. What type of network attack or anomaly does this signature indicate?
A security architect is designing a Zero Trust Network Access (ZTNA) solution to replace a legacy remote access VPN. Unlike traditional VPNs that grant network-level access upon initial authentication, how does a true service-initiated ZTNA architecture handle application access for a remote user?
An organization is hardening its wireless network infrastructure to prevent unauthorized client association and eavesdropping. Which TWO wireless security mechanisms should be enforced according to modern enterprise standards? (Choose two)
A network administrator is deploying a new 802.1X-based Network Access Control (NAC) solution on Cisco Catalyst switches to authenticate employee laptops before granting them access to the corporate VLAN. The security policy requires that the switches themselves validate user credentials against the corporate Active Directory and then dynamically assign the correct VLAN based on the user's role. Which 802.1X component must be configured on the switches to fulfill this requirement?
A network security administrator is configuring a demilitarized zone (DMZ) firewall rule set. The policy states that external users must reach a public web server on TCP 443, but the web server must never initiate connections to the internal network. The firewall is a stateful inspection device with three interfaces: outside, DMZ, and inside. Which rule set best enforces this policy?
An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?
An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?
A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?
A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?
A network engineer is configuring TLS 1.3 on an enterprise load balancer. During cipher suite selection, the engineer observes that cipher suites like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 are no longer listed in the configuration menu. What is the primary reason for this change in TLS 1.3?
A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?
An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?
A security engineer is tasked with restricting network access to a sensitive database server so that only the application server VLAN can communicate with it on TCP port 1433. The database server is hosted on a virtualized hypervisor switch. Where should this micro-segmentation control be implemented for optimal enforcement?
An enterprise network security team is analyzing BGP routing anomalies at the internet edge. An attacker is attempting to inject malicious routing updates to hijack corporate IP space (BGP prefix hijacking). Which mechanism should the network edge routers implement to cryptographically verify the origin autonomy of IP prefixes?
A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?
An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?
A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?
An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?
An enterprise is deploying an IPsec site-to-site VPN. The security team wants to ensure that if an attacker captures today's encrypted network traffic, they cannot decrypt it even if they eventually compromise the long-term preshared keys or private keys used during the initial key exchange. What cryptographic property must be enforced?
A security analyst observes that an internal host is generating excessive DNS queries containing encoded data within subdomains, indicative of a DNS tunneling attack. The network perimeter firewall allows outbound DNS traffic on UDP port 53 to any external IP. Which network security control should be implemented to mitigate this threat?
An organization wants to protect internal workstations by deploying a host-based firewall that evaluates inbound and outbound connection requests based on application executable names rather than just IP addresses and port numbers. Which Windows built-in security feature provides this capability?
A security engineer is configuring a Next-Generation Firewall (NGFW) to perform deep packet inspection (DPI) on encrypted TLS traffic. Due to privacy regulations, specific internal banking applications must be excluded from SSL decryption. How should the engineer configure the firewall to bypass decryption for these specific destinations without disabling overall inspection?
An organization is deploying an Intrusion Prevention System (IPS) in an enterprise data center. To minimize latency and avoid becoming a single point of failure that disrupts network uptime if the hardware fails, the engineering team chooses a specific deployment topology. Which deployment option provides inline inspection with hardware-level bypass capability?
A network engineer is configuring an OpenVPN server in TUN mode for remote workers. What is the fundamental characteristic of TUN mode compared to TAP mode regarding network layer operation?
An enterprise network uses VLANs to separate departments. Users in the Marketing VLAN need to access a printer located in the Sales VLAN. Which network device is strictly required to route traffic between these two distinct VLANs?
A security engineer is performing a security audit of an enterprise firewall and discovers several misconfigurations. Which THREE of the following practices represent severe security vulnerabilities in firewall deployment? (Choose three)
A network administrator is configuring secure remote access for employees. The security policy mandates that the remote access solution must support multi-factor authentication (MFA) and encrypt all traffic from the client device. Which TWO technologies or protocols can meet these requirements? (Choose two)
A network administrator is implementing defense-in-depth measures against ARP spoofing and man-in-the-middle attacks on a Cisco switched enterprise network. Which THREE switch security features should be enabled on access layer ports? (Choose three)
An organization is designing a redundant network architecture to prevent single points of failure at the gateway level. Which THREE protocols or features are commonly used to provide gateway redundancy and high availability for default routers or firewalls? (Choose three)
A security analyst is investigating a compromised network segment and discovers that an attacker bypassed network perimeter access controls by tunneling malicious command-and-control traffic through allowed protocols. Which THREE protocols are most commonly abused for covert data exfiltration and tunneling through corporate firewalls? (Choose three)
An enterprise security architect is designing a Zero Trust network segmentation model. Which THREE core principles are foundational to Zero Trust architecture regarding network access and device verification? (Choose three)
A network engineer is configuring IPsec site-to-site VPN policies. During Phase 2 negotiations, which TWO parameters must match identically on both VPN peers for the security association (SA) to establish successfully? (Choose two)
A network administrator is configuring an intrusion prevention system (IPS) and needs to understand how signature-based and anomaly-based detection engines operate. Which TWO statements accurately describe anomaly-based IPS detection? (Choose two)
A security engineer needs to configure secure log management and transmission from edge firewalls and switches to a centralized SIEM server. Which TWO protocols or features ensure that log data is transmitted securely and integrally across the network? (Choose two)
A security team is conducting a penetration test against a corporate network and attempts a Man-in-the-Middle (MitM) attack using ICMP redirection and IPv6 Router Advertisement (RA) spoofing. Which THREE network controls effectively mitigate these specific local network redirection attacks? (Choose three)
A security engineer is evaluating a network intrusion prevention system (NIPS) that must inspect traffic flowing between two internal VLANs at 10 Gbps. The requirement is to detect and block exploits without introducing asymmetric routing, and the device must remain transparent to Layer 2 and Layer 3 topologies. Which deployment mode should the engineer choose?
A security architect is designing network access control for a campus LAN. The requirement is to authenticate users and devices, assign VLANs dynamically based on identity, and quarantine non-compliant endpoints before granting production access. Which combination of protocols and features should the architect implement?