Network Perimeter Protection

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

What is the primary purpose of deploying a Network Intrusion Detection System (NIDS) in promiscuous mode on a perimeter switch span/mirror port?

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

Which TWO of the following are characteristics of a honeynet compared to a standard honeypot? (Choose TWO)

Which TWO of the following characteristics accurately differentiate a Next-Generation Firewall (NGFW) from a traditional stateless or stateful inspection firewall? (Choose two)

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

A security engineer is designing a segmented network perimeter using a traditional three-tier architecture. Which zone should house public-facing web servers and mail relay servers, ensuring they are isolated from both the internal trusted LAN and the public internet via distinct firewall contexts?

A security architect is configuring an enterprise-grade Application Layer Gateway (ALG) stateful firewall to inspect active FTP data channels. The firewall must dynamically open ephemeral ports for incoming data connections based on control channel negotiations. Which firewall configuration mechanism must be enabled to support this behavior?

When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?

A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that have the SYN flag set while the FIN flag is also set, which is a common malformed packet attack vector. Which iptables command should the engineer use?

An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which THREE best practices should be implemented? (Choose THREE)

An enterprise perimeter firewall is experiencing a volumetric SYN flood denial-of-service attack. The network administrator wants to mitigate the attack at the firewall level without dropping legitimate client connections or modifying the internal server TCP stack configurations. Which specialized firewall feature should be activated?

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?

An administrator is deploying a Snort 3 Intrusion Detection System on an enterprise gateway segment. To detect a specific exploit payload containing the exact ASCII string \x41\x41\x41\x41 without relying on preprocessors, which rule option should be implemented?

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

When deploying an Intrusion Prevention System (IPS) in an inline network architecture, which THREE critical operational factors must security engineers evaluate to prevent network disruption? (Choose THREE)

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

An organization deploys an inline Intrusion Prevention System (IPS) that begins dropping legitimate business-critical transactions due to false positives caused by a custom application protocol. What is the most appropriate immediate action for the security team while maintaining perimeter visibility?

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?

A security engineer is configuring a firewall to prevent IP address spoofing from the external untrusted interface. Which built-in routing/firewall feature checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface expected for that source network?

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

An administrator is configuring a Cisco ASA firewall and needs to allow internal users to initiate outbound HTTP/HTTPS sessions while ensuring that return traffic is permitted through the stateful inspection engine without opening explicit inbound rules. Which object-group and access-list construct properly permits outbound web traffic?

Which protocol is commonly used to securely manage network perimeter devices via an encrypted command-line interface instead of plaintext Telnet?

An attacker performs a TCP SYN flood attack against a perimeter web server protected by a firewall. The security engineer enables SYN cookies on the firewall/router. How does this feature mitigate the attack?

A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

An organization wants to deploy a low-interaction honeypot that mimics common vulnerable network services (like SSH, Telnet, and FTP) to quickly log unauthorized login attempts and brute-force attacks. Which open-source tool is best suited for this task?

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)