CND Network Attacks And Defense Strategies Practice Question
An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID controls.
Next-Generation Firewalls (NGFW) utilize Deep Packet Inspection (DPI) and App-ID features to identify applications regardless of port numbers, allowing administrators to enforce strict outbound application control policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a stateless packet filtering access control list on the core router interface.
Why it's wrong here
Stateless ACLs examine only header fields (IP/port) and cannot inspect application payloads.
- ✗
Activate standard IP source guard on all internal user-facing switch access ports.
Why it's wrong here
IP Source Guard prevents IP spoofing on local switch ports, not application data exfiltration.
- ✗
Enable Network Address Translation (NAT) overload (PAT) on the perimeter router.
Why it's wrong here
PAT maps private IP addresses to public IPs for routing; it provides no payload inspection.
- ✓
Deploy a Next-Generation Firewall (NGFW) with Deep Packet Inspection (DPI) and App-ID controls.
Why this is correct
NGFW with DPI and App-ID inspects application payloads rather than relying solely on port numbers.
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.