CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Zone-Based Policy Firewall

  Why it's wrong here

  Zone-Based Policy Firewall enforces stateful traffic policy between security zones, controlling which sessions are permitted between network segments. It operates at the flow and port level and does not inspect HTTP payloads for scripting or SQL injection patterns. It is useful for segmentation but cannot detect or block application-layer attacks embedded in otherwise permitted HTTP requests.

• ✗

  IPsec VPN with AES encryption

  Why it's wrong here

  IPsec provides confidentiality and integrity for traffic in transit between peers, but it does not inspect the contents of decrypted application requests for attack signatures. An attacker sending a malicious HTTP request over an IPsec tunnel would still have that request delivered. Encryption addresses eavesdropping and tampering, not application-layer exploit detection.

• ✓

  Cisco IOS IPS with signature-based inspection

  Why this is correct

  Cisco IOS Intrusion Prevention System inspects packet payloads against signatures and can detect and drop application-layer attacks such as cross-site scripting and SQL injection. Because it examines the content of HTTP requests, it can block malicious patterns without any change to the hosted application, matching the requirement to protect the web app transparently.

• ✗

  Control Plane Policing

  Why it's wrong here

  Control Plane Policing rate-limits traffic destined to the router's own control plane, protecting CPU-bound processes from floods. It does not inspect application payloads and has no concept of HTTP request content. While it can mitigate certain denial-of-service conditions against the device, it cannot detect or block cross-site scripting or SQL injection targeting a web application.