GSEC Network Security Devices — 15 Questions

Question 1

An enterprise network administrator is deploying a next-generation firewall (NGFW) to inspect encrypted traffic. Which architecture allows the NGFW to decrypt and inspect inbound HTTPS traffic destined for internal web servers without compromising private keys on every server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inbound SSL Decryption utilizing the server private key on the firewall. Inbound SSL decryption requires importing the internal server's private key and certificate directly onto the firewall appliance. This enables the NGFW to terminate the TLS session, inspect the payload for malicious content, and re-establish a secure connection to the backend server, maintaining security while centralizing certificate management and threat detection.

Answer

SSL Forward Proxy inspection

Answer

SSH Proxy tunneling with asymmetric key exchange

Answer

Transparent proxy mode without certificate installation

Question 2

A security analyst is hardening an enterprise perimeter firewall and evaluating different deployment modes. Which TWO characteristics accurately describe a firewall operating in transparent (virtual wire or layer 2) mode?

Accepted Answer

It performs packet inspection and filtering without requiring an IP address assigned to the interface for routing purposes.. A transparent firewall operates at Layer 2 of the OSI model, acting like a bridge or switch interface where traffic passes through without changing IP addresses or routing paths. This allows seamless integration into existing network topologies without requiring subnet renumbering, making it ideal for inserting security inspection points directly into legacy architectures.

Answer

It alters the destination IP address of incoming packets to perform network address translation across subnets.

Answer

It requires a complete redesign of the core routing table and gateway IP assignments across all internal subnets.

Answer

It operates strictly at Layer 3 of the OSI model, requiring static routes for every connected subnet.

Question 3

Refer to the exhibit. An administrator implemented the above configuration on a router acting as the network perimeter security device. Based on the configuration snippet, what specific security function is being applied to incoming traffic?

Accepted Answer

Traffic policing and packet dropping based on customized behavioral signatures. The configuration demonstrates a Modular Quality of Service Command-Line Interface (MQC) policy map combined with class maps to identify specific protocol and packet length criteria, followed by a drop action. This mechanism acts as a rudimentary traffic filter and rate-limiting defense against specific anomalous payload characteristics.

Answer

IPsec site-to-site virtual private network tunnel termination

Answer

Stateful packet inspection inspecting TCP connection state tables

Answer

Deep packet inspection utilizing signature databases to block malware payloads

Question 4

An organization is planning to deploy an inline Intrusion Prevention System (IPS) on a high-speed 10Gbps backbone link. Which TWO factors must the engineering team evaluate to prevent the IPS from becoming a network bottleneck?

Accepted Answer

Maximum sustained bidirectional throughput capacity under full signature inspection load. Inline IPS devices must process every packet in real-time before forwarding, making throughput and latency critical engineering metrics. Under heavy load or during large attacks, insufficient hardware capacity can cause the IPS to drop packets or fail open/closed, severely impacting network availability.

Answer

The number of static IP routing tables supported by the device operating system

Answer

Network time protocol synchronization accuracy across global time zones

Answer

The total physical rack unit size and power supply voltage requirements in the data center

Question 5

An organization deploys a stateful inspection firewall between the internal network and the internet. A critical database server needs to receive incoming traffic on a specific high-numbered port for a legacy application. Which action ensures the firewall permits the return traffic for this connection while maintaining security?

Accepted Answer

Allow the initial connection and rely on the state table for return traffic.. Stateful inspection firewalls track the state of active connections by recording session information in a state table. By identifying the initial outbound SYN packet or the inbound connection request allowed by policy, the firewall automatically creates a temporary dynamic rule for the return traffic. This mechanism eliminates the need to open static holes in the inbound ruleset, significantly reducing the attack surface by only allowing packets related to established sessions.

Answer

Manually create an inbound allow rule for the high-numbered port.

Answer

Disable the firewall's stateful inspection engine for the database segment.

Answer

Implement a transparent bridge mode to bypass stateful inspection.

Question 6

A security analyst needs to capture raw packet data from a high-speed core switch to analyze suspicious east-west traffic movements without interrupting production data flows. Which device feature should be configured on the switch?

Accepted Answer

Switched Port Analyzer (SPAN) or port mirroring. A Switched Port Analyzer (SPAN), also known as port mirroring, duplicates ingress and egress traffic from specified source ports or VLANs and forwards the copied frames to a dedicated monitoring port connected to a packet analyzer or intrusion detection sensor without disrupting production flows.

Answer

Network Address Translation (NAT) overloading

Answer

Virtual Router Redundancy Protocol (VRRP) failover

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Question 7

An organization deploys a network-based Intrusion Detection System (IDS) in passive monitoring mode on a core switch trunk link. If the IDS detects an active external command-and-control connection to an infected internal workstation, what action does the IDS take?

Accepted Answer

It generates an alert log entry and notifies security analysts via SIEM integration or SNMP traps.. A network-based IDS operates in passive monitoring mode, receiving mirrored traffic copies via a SPAN port or network tap. Because it is deployed out-of-band, it cannot inline drop packets; instead, it generates security alerts, logs events, and can trigger external response mechanisms like SNMP traps or API calls.

Answer

It automatically injects TCP reset (RST) packets into the stream to terminate the active session.

Answer

It drops the malicious packets at the interface level to protect the internal workstation from further compromise.

Answer

It dynamically updates the core switch routing table to quarantine the infected workstation into an isolated VLAN.

Question 8

Refer to the exhibit. A network administrator applies this ACL to a router interface. A user from the 192.168.1.0/24 subnet attempts to access the web server at 10.0.5.5 on port 80. What is the result of this traffic flow?

Accepted Answer

The traffic is denied because the first rule matches and terminates evaluation.. Cisco standard and extended ACLs process rules sequentially from top to bottom. The first rule explicitly denies any IP traffic to the host 10.0.5.5 on port 80. Because this deny rule is matched first, the router immediately drops the packet before evaluating subsequent lines. Even though the second rule would have permitted the traffic, it is unreachable due to the specificity and position of the initial deny statement.

Answer

The traffic is permitted because the second rule matches the source subnet.

Answer

The traffic is permitted because permit rules take precedence over deny rules.

Answer

The router generates an error because the ACL rules are contradictory.

Question 9

A security engineer at a hospital is deploying an inline network Intrusion Prevention System (IPS) on a 10 Gbps link between the clinical VLAN and the data center. The IPS must block exploits without introducing latency that would disrupt real-time patient monitoring. Which deployment consideration is MOST critical to meet this requirement?

Accepted Answer

Verify the IPS can perform inspection at line rate with low latency and has a hardware bypass mechanism to maintain availability if it fails.. An inline IPS on a critical 10 Gbps link must inspect and block at line rate while not introducing latency that disrupts real-time applications. A hardware bypass or fail-to-wire mechanism is essential to maintain network availability if the IPS fails, which is especially important in a hospital setting. Performance and availability are the key considerations for this deployment.

Answer

Configure the IPS in tap mode with a fail-open bypass so it can inspect traffic without being in the forwarding path.

Answer

Enable full packet capture on the IPS to record all traffic for forensic analysis, accepting the performance overhead.

Answer

Deploy the IPS in promiscuous mode and rely on span ports to mirror traffic from the core switch.

Question 10

A financial institution uses a stateful firewall between its internal network and the internet. An administrator notices that return traffic for outbound connections is being blocked even though the outbound rules are correct. The firewall logs show that the return packets are being dropped because they do not match any existing session. Which feature should the administrator verify is enabled to allow return traffic for legitimate outbound sessions?

Accepted Answer

Stateful inspection with session tracking. Stateful inspection with session tracking allows the firewall to dynamically permit return traffic for outbound connections by maintaining a session table. Without it, return packets are treated as new inbound traffic and may be blocked by default. The administrator should verify that stateful inspection is enabled and that the session table is not exhausted, which can cause drops.

Answer

Access control lists (ACLs) applied to the inbound interface

Answer

Deep packet inspection (DPI) with application signatures

Answer

Network address translation (NAT) with port forwarding

Question 11

A hospital's security team wants to inspect traffic between its clinical VLAN and its guest Wi-Fi VLAN, but the network must keep forwarding packets even if the inspection appliance loses power. The appliance will be inserted transparently without changing IP addressing on either VLAN. Which deployment approach BEST satisfies these requirements?

Accepted Answer

Deploy a Layer 2 bridge running in inline mode with a hardware bypass fail-to-wire segment.. Transparent inline bridging with a hardware bypass segment keeps the appliance invisible at Layer 3 while still allowing it to enforce policy on traffic crossing between VLANs. The fail-to-wire path guarantees that clinical connectivity survives a power loss, which is the decisive requirement distinguishing this from passive monitoring or routed insertion.

Answer

Deploy the appliance as a routed hop between the two VLANs with a static route on each side.

Answer

Deploy a TAP aggregator that mirrors both VLANs to the appliance and enable fail-open on the NIC.

Answer

Deploy a SPAN port on the core switch and attach the appliance in passive monitor-only mode.

Question 12

A financial services firm is selecting a web application firewall (WAF) to protect an internet-facing banking portal that uses TLS 1.3 exclusively. The security architect must ensure the WAF can inspect encrypted sessions and detect attacks that unfold across many requests from the same client. Which TWO capabilities are MOST relevant to these requirements? (Choose two.)

Accepted Answer

Terminating TLS at the WAF using a certificate and private key trusted by the portal's clients.. Inspecting TLS 1.3 forces the WAF to act as a TLS endpoint with the portal's certificate and key, because encrypted payloads are otherwise opaque. Detecting attacks spread across many requests requires persistent per-client session tracking and behavioral scoring, so those two capabilities together satisfy the architect's requirements.

Answer

Configuring the WAF to operate only in detection mode with alerts sent to a SIEM.

Answer

Enabling promiscuous mode on the WAF's management interface.

Answer

Disabling HTTP keep-alive so every request opens a fresh TCP connection.

Question 13

A retail company runs a stateful firewall at its internet edge. Users complain that long-lived SSH sessions to a partner are being dropped roughly every hour even though no idle timeout is configured on the client. Which firewall behavior is the MOST likely cause?

Accepted Answer

The firewall's TCP session table entry is expiring because the connection has been idle longer than the configured state timeout.. Stateful inspection maintains a session table whose entries expire according to protocol idle timers. An SSH connection that sends no data for the duration of the TCP established timeout is silently removed, after which the firewall no longer recognizes return packets as part of an existing flow and drops them.

Answer

The firewall is applying egress filtering that blocks the partner's return traffic after the first hour.

Answer

The firewall is performing full packet reassembly and rejecting out-of-order TCP segments from the partner.

Answer

The firewall's ALG for SSH is rewriting the sequence numbers and desynchronizing the endpoints.

Question 14

A security engineer is configuring an inline intrusion prevention system (IPS) on a 10 Gbps internal segment. During a pilot, the IPS begins dropping legitimate business traffic because its inspection engine cannot keep pace with bursts. Which deployment adjustment best preserves inline prevention while reducing false drops?

Accepted Answer

Tune the IPS inspection profile to match the segment's actual protocols and disable signatures for services not present on that segment.. Inline IPS overload is usually caused by inspecting traffic and signatures that do not apply to the protected segment. Profiling the segment and disabling irrelevant signatures reduces CPU and memory pressure, allowing the engine to keep up with burst traffic while still enforcing inline prevention. The other choices either remove inline enforcement or fail to address the actual capacity bottleneck, so they do not meet the requirement of preserving prevention while reducing false drops.

Answer

Enable fail-open bypass on the IPS so that traffic is forwarded without inspection when the inspection engine is overwhelmed.

Answer

Move the IPS to a passive TAP and rely on alerts to manually block offending sources at the firewall.

Answer

Increase the IPS fail-closed timeout so that traffic is buffered longer during inspection spikes.

Question 15

A network security team is deploying a web application firewall (WAF) in front of an e-commerce site. The security architect wants the WAF to learn normal application behavior and block deviations without manually writing signatures for every new attack. Which WAF deployment and configuration approach best matches this requirement?

Accepted Answer

Deploy the WAF in reverse proxy mode with anomaly detection and a learning period that builds a baseline of normal application behavior before enforcement.. Behavioral anomaly detection in a reverse proxy WAF builds a baseline of normal application behavior during a learning period, then flags and blocks requests that deviate from that baseline. This reduces reliance on manually written signatures and matches the architect's goal. Transparent bridge with a positive model still needs explicit definitions, monitor-only mode cannot block, and host-based static rules do not learn, so the reverse proxy anomaly approach is the only one that satisfies all stated requirements.

Answer

Deploy the WAF as a host-based agent on each web server with a static rule set based on the OWASP Core Rule Set.

Answer

Deploy the WAF in monitor-only mode with signature-based rules and alert on known attack patterns.

Answer

Deploy the WAF in transparent bridge mode with a positive security model that only allows explicitly defined methods, parameters, and content types.