GSEC Network Security Devices — Timed 10 Questions

Question 1

An enterprise network administrator is deploying a next-generation firewall (NGFW) to inspect encrypted traffic. Which architecture allows the NGFW to decrypt and inspect inbound HTTPS traffic destined for internal web servers without compromising private keys on every server?

10 minute time limit — choose an answer to begin.

Accepted Answer

Inbound SSL Decryption utilizing the server private key on the firewall. Inbound SSL decryption requires importing the internal server's private key and certificate directly onto the firewall appliance. This enables the NGFW to terminate the TLS session, inspect the payload for malicious content, and re-establish a secure connection to the backend server, maintaining security while centralizing certificate management and threat detection.

Answer

SSL Forward Proxy inspection

Answer

SSH Proxy tunneling with asymmetric key exchange

Answer

Transparent proxy mode without certificate installation

Question 2

A security analyst is hardening an enterprise perimeter firewall and evaluating different deployment modes. Which TWO characteristics accurately describe a firewall operating in transparent (virtual wire or layer 2) mode?

Accepted Answer

It performs packet inspection and filtering without requiring an IP address assigned to the interface for routing purposes.. A transparent firewall operates at Layer 2 of the OSI model, acting like a bridge or switch interface where traffic passes through without changing IP addresses or routing paths. This allows seamless integration into existing network topologies without requiring subnet renumbering, making it ideal for inserting security inspection points directly into legacy architectures.

Answer

It alters the destination IP address of incoming packets to perform network address translation across subnets.

Answer

It requires a complete redesign of the core routing table and gateway IP assignments across all internal subnets.

Answer

It operates strictly at Layer 3 of the OSI model, requiring static routes for every connected subnet.

Question 3

Refer to the exhibit. An administrator implemented the above configuration on a router acting as the network perimeter security device. Based on the configuration snippet, what specific security function is being applied to incoming traffic?

Accepted Answer

Traffic policing and packet dropping based on customized behavioral signatures. The configuration demonstrates a Modular Quality of Service Command-Line Interface (MQC) policy map combined with class maps to identify specific protocol and packet length criteria, followed by a drop action. This mechanism acts as a rudimentary traffic filter and rate-limiting defense against specific anomalous payload characteristics.

Answer

IPsec site-to-site virtual private network tunnel termination

Answer

Stateful packet inspection inspecting TCP connection state tables

Answer

Deep packet inspection utilizing signature databases to block malware payloads

Question 4

An organization is planning to deploy an inline Intrusion Prevention System (IPS) on a high-speed 10Gbps backbone link. Which TWO factors must the engineering team evaluate to prevent the IPS from becoming a network bottleneck?

Accepted Answer

Maximum sustained bidirectional throughput capacity under full signature inspection load. Inline IPS devices must process every packet in real-time before forwarding, making throughput and latency critical engineering metrics. Under heavy load or during large attacks, insufficient hardware capacity can cause the IPS to drop packets or fail open/closed, severely impacting network availability.

Answer

The number of static IP routing tables supported by the device operating system

Answer

Network time protocol synchronization accuracy across global time zones

Answer

The total physical rack unit size and power supply voltage requirements in the data center

Question 5

An organization deploys a stateful inspection firewall between the internal network and the internet. A critical database server needs to receive incoming traffic on a specific high-numbered port for a legacy application. Which action ensures the firewall permits the return traffic for this connection while maintaining security?

Accepted Answer

Allow the initial connection and rely on the state table for return traffic.. Stateful inspection firewalls track the state of active connections by recording session information in a state table. By identifying the initial outbound SYN packet or the inbound connection request allowed by policy, the firewall automatically creates a temporary dynamic rule for the return traffic. This mechanism eliminates the need to open static holes in the inbound ruleset, significantly reducing the attack surface by only allowing packets related to established sessions.

Answer

Manually create an inbound allow rule for the high-numbered port.

Answer

Disable the firewall's stateful inspection engine for the database segment.

Answer

Implement a transparent bridge mode to bypass stateful inspection.

Question 6

A security analyst needs to capture raw packet data from a high-speed core switch to analyze suspicious east-west traffic movements without interrupting production data flows. Which device feature should be configured on the switch?

Accepted Answer

Switched Port Analyzer (SPAN) or port mirroring. A Switched Port Analyzer (SPAN), also known as port mirroring, duplicates ingress and egress traffic from specified source ports or VLANs and forwards the copied frames to a dedicated monitoring port connected to a packet analyzer or intrusion detection sensor without disrupting production flows.

Answer

Network Address Translation (NAT) overloading

Answer

Virtual Router Redundancy Protocol (VRRP) failover

Answer

Dynamic Host Configuration Protocol (DHCP) snooping

Question 7

An organization deploys a network-based Intrusion Detection System (IDS) in passive monitoring mode on a core switch trunk link. If the IDS detects an active external command-and-control connection to an infected internal workstation, what action does the IDS take?

Accepted Answer

It generates an alert log entry and notifies security analysts via SIEM integration or SNMP traps.. A network-based IDS operates in passive monitoring mode, receiving mirrored traffic copies via a SPAN port or network tap. Because it is deployed out-of-band, it cannot inline drop packets; instead, it generates security alerts, logs events, and can trigger external response mechanisms like SNMP traps or API calls.

Answer

It automatically injects TCP reset (RST) packets into the stream to terminate the active session.

Answer

It drops the malicious packets at the interface level to protect the internal workstation from further compromise.

Answer

It dynamically updates the core switch routing table to quarantine the infected workstation into an isolated VLAN.

Question 8

Refer to the exhibit. A network administrator applies this ACL to a router interface. A user from the 192.168.1.0/24 subnet attempts to access the web server at 10.0.5.5 on port 80. What is the result of this traffic flow?

Accepted Answer

The traffic is denied because the first rule matches and terminates evaluation.. Cisco standard and extended ACLs process rules sequentially from top to bottom. The first rule explicitly denies any IP traffic to the host 10.0.5.5 on port 80. Because this deny rule is matched first, the router immediately drops the packet before evaluating subsequent lines. Even though the second rule would have permitted the traffic, it is unreachable due to the specificity and position of the initial deny statement.

Answer

The traffic is permitted because the second rule matches the source subnet.

Answer

The traffic is permitted because permit rules take precedence over deny rules.

Answer

The router generates an error because the ACL rules are contradictory.

Question 9

A security engineer at a hospital is deploying an inline network Intrusion Prevention System (IPS) on a 10 Gbps link between the clinical VLAN and the data center. The IPS must block exploits without introducing latency that would disrupt real-time patient monitoring. Which deployment consideration is MOST critical to meet this requirement?

Accepted Answer

Verify the IPS can perform inspection at line rate with low latency and has a hardware bypass mechanism to maintain availability if it fails.. An inline IPS on a critical 10 Gbps link must inspect and block at line rate while not introducing latency that disrupts real-time applications. A hardware bypass or fail-to-wire mechanism is essential to maintain network availability if the IPS fails, which is especially important in a hospital setting. Performance and availability are the key considerations for this deployment.

Answer

Configure the IPS in tap mode with a fail-open bypass so it can inspect traffic without being in the forwarding path.

Answer

Enable full packet capture on the IPS to record all traffic for forensic analysis, accepting the performance overhead.

Answer

Deploy the IPS in promiscuous mode and rely on span ports to mirror traffic from the core switch.

Question 10

A financial institution uses a stateful firewall between its internal network and the internet. An administrator notices that return traffic for outbound connections is being blocked even though the outbound rules are correct. The firewall logs show that the return packets are being dropped because they do not match any existing session. Which feature should the administrator verify is enabled to allow return traffic for legitimate outbound sessions?

Accepted Answer

Stateful inspection with session tracking. Stateful inspection with session tracking allows the firewall to dynamically permit return traffic for outbound connections by maintaining a session table. Without it, return packets are treated as new inbound traffic and may be blocked by default. The administrator should verify that stateful inspection is enabled and that the session table is not exhausted, which can cause drops.

Answer

Access control lists (ACLs) applied to the inbound interface

Answer

Deep packet inspection (DPI) with application signatures

Answer

Network address translation (NAT) with port forwarding