Network Perimeter Protection

Which TWO deployment methods or modes are commonly used to collect traffic for a Network Intrusion Detection System (NIDS)? (Choose TWO)

A network engineer is configuring a Linux firewall using nftables and needs to create a table for packet filtering, add a base chain for incoming traffic on the input hook, and set the default policy to drop. Which command sequence accomplishes this?

Which network device operates at Layer 3 and Layer 4 to inspect packet headers and make dynamic forwarding decisions based on established connection states?

A network security engineer wants to deploy a perimeter defense mechanism that acts as a decoy system, purposely loaded with vulnerabilities to lure attackers away from production assets and collect telemetry on their tactics. What is this technology called?

An enterprise network administrator is troubleshooting persistent packet drops at the perimeter firewall. Which THREE diagnostic tools or commands are most effective for identifying where and why traffic is being dropped? (Choose THREE)

A security analyst is reviewing logs from a host-based Intrusion Prevention System (HIPS). The system successfully identified and blocked an injection attack by terminating the offending process instantly. What type of proactive preventive action did the HIPS execute?

A network security engineer is deploying a new e-commerce web farm behind an Application Delivery Controller in the screened subnet. The organization requires that inbound HTTPS sessions be terminated and re-encrypted to the backend web servers, that the ADC validate client certificates, and that the ADC block HTTP requests containing SQL injection patterns before they reach the servers. Which capability must the ADC provide to meet these requirements?

Which TWO features are commonly found in Enterprise Next-Generation Firewalls (NGFW) that distinguish them from traditional stateful inspection firewalls? (Choose TWO)

What is the primary purpose of deploying a Network Intrusion Detection System (NIDS) in promiscuous mode on a perimeter switch span/mirror port?

A security architect is designing a high-security perimeter utilizing a dual-firewall DMZ architecture (back-to-back firewalls). Which traffic flow configuration best implements security best practices between the external router, perimeter firewall, DMZ, and internal firewall?

A security analyst is configuring a Palo Alto Networks firewall and needs to configure a security rule that inspects web-browsing traffic for known malware signatures and prevents vulnerability exploits. Where within the security rule base should this threat profile be attached?

Which TWO of the following are characteristics of a honeynet compared to a standard honeypot? (Choose TWO)

A security team is reviewing perimeter firewall logs and observes that an external host is sending TCP segments with the FIN flag set but no prior SYN, and also sending TCP segments with both SYN and FIN flags set simultaneously. The firewall is stateful and currently drops these packets. Which statement best describes what the attacker is attempting and the correct defensive interpretation?

Which TWO of the following characteristics accurately differentiate a Next-Generation Firewall (NGFW) from a traditional stateless or stateful inspection firewall? (Choose two)

A network engineer is troubleshooting an enterprise Next-Generation Firewall (NGFW) and notices that encrypted HTTPS traffic is bypassing Deep Packet Inspection (DPI) signatures. What feature must be configured on the NGFW to inspect the payload of these encrypted sessions?

A security engineer is designing a segmented network perimeter using a traditional three-tier architecture. Which zone should house public-facing web servers and mail relay servers, ensuring they are isolated from both the internal trusted LAN and the public internet via distinct firewall contexts?

A security architect is configuring an enterprise-grade Application Layer Gateway (ALG) stateful firewall to inspect active FTP data channels. The firewall must dynamically open ephemeral ports for incoming data connections based on control channel negotiations. Which firewall configuration mechanism must be enabled to support this behavior?

When designing a secure network perimeter, what is the term used for breaking a large network into smaller, isolated subnetworks to contain breaches and control lateral movement?

An organization is designing a perimeter architecture with two firewalls from different vendors placed in series between the internet and the internal network. A security architect argues this dual-vendor design improves defense in depth. Which statement best describes a realistic operational consideration of this design?

A network security engineer needs to configure a Linux-based iptables firewall to drop all incoming TCP packets that have the SYN flag set while the FIN flag is also set, which is a common malformed packet attack vector. Which iptables command should the engineer use?

An organization is hardening its perimeter firewall configuration against reconnaissance and volumetric attacks. Which THREE best practices should be implemented? (Choose THREE)

Which TWO configuration steps are typically required when deploying a firewall in Transparent (Layer 2) mode rather than Routed (Layer 3) mode? (Choose TWO)

An organization is setting up a high-availability perimeter firewall pair. Which protocol is commonly utilized to provide seamless failover by sharing a virtual IP address between the active and standby firewalls?

An enterprise security team needs to deploy a Snort rule that detects an HTTP GET request containing a specific directory traversal string (../../etc/passwd). Which rule header and options structure correctly formats this signature?

An organization wants to deploy a low-interaction honeypot within its DMZ network to detect unauthorized reconnaissance activity, scanning, and basic service probing without risking the compromise of an actual operating system. Which tool is best suited for this requirement?

When deploying an Intrusion Prevention System (IPS) in an inline network architecture, which THREE critical operational factors must security engineers evaluate to prevent network disruption? (Choose THREE)

Which type of firewall inspects traffic at the application layer (Layer 7) and understands specific application protocols like HTTP, FTP, or SIP to make granular filtering decisions?

An organization deploys an inline Intrusion Prevention System (IPS) that begins dropping legitimate business-critical transactions due to false positives caused by a custom application protocol. What is the most appropriate immediate action for the security team while maintaining perimeter visibility?

An enterprise network administrator needs to place a publicly accessible web server on the network perimeter. Which network zone should the administrator configure to isolate this server from the internal corporate network while keeping it accessible from the internet?

An administrator needs to segment an internal network into multiple Virtual LANs (VLANs) to isolate the finance department from human resources. Which IEEE standard protocol must be configured on the interconnecting switch trunk ports to tag frames belonging to different VLANs?

A security engineer is deploying an inline NIPS appliance between the perimeter firewall and the internal core switch. During testing, legitimate TCP sessions from branch offices are being reset mid-transfer, and packet captures show the sensor injecting RST packets to both endpoints. Which configuration change will most directly stop the NIPS from breaking these legitimate flows?

A security engineer is configuring a firewall to prevent IP address spoofing from the external untrusted interface. Which built-in routing/firewall feature checks the source IP address of incoming packets against the routing table to verify that the packet arrived on the interface expected for that source network?

Which TWO methods are commonly used by Intrusion Detection and Prevention Systems (IDPS) to identify malicious network traffic? (Choose TWO)

Which TWO of the following are primary benefits of implementing network segmentation at an enterprise perimeter? (Choose TWO)

A security analyst configuring a Linux-based iptables firewall wants to ensure that any established or related incoming TCP connections are automatically allowed through without hitting subsequent rule checks. Which target and match extension combination should be used?

Which protocol is commonly used to securely manage network perimeter devices via an encrypted command-line interface instead of plaintext Telnet?

An attacker performs a TCP SYN flood attack against a perimeter web server protected by a firewall. The security engineer enables SYN cookies on the firewall/router. How does this feature mitigate the attack?

A security architect is designing a secure DMZ architecture utilizing multiple security zones on a firewall. Which THREE design principles should guide the implementation? (Choose THREE)

Which TWO of the following deployment scenarios or features are commonly associated with Network Intrusion Prevention Systems (NIPS)? (Choose two)

A security administrator is hardening a corporate perimeter router and wants to protect the router's control plane against CPU exhaustion attacks from external flooding. Which feature should be implemented?

A small business wants to prevent employees from accessing known malicious websites and to log all outbound web requests for later review. The administrator has no budget for a full next-generation firewall and wants a solution that can be deployed as a transparent bridge without changing client IP configurations. Which perimeter control best fits these requirements?

A network defender is hardening a perimeter firewall to resist evasion techniques that manipulate packet fragmentation and TCP options. Which TWO measures should be implemented to improve the firewall's ability to correctly reassemble and inspect fragmented traffic? (Choose two.)

An enterprise firewall is experiencing asymmetric routing where TCP SYN packets enter through Firewall A, but the return SYN-ACK packets exit through Firewall B due to dynamic routing changes. What firewall feature must be enabled to synchronize connection state tables between Firewall A and Firewall B and prevent connection drops?

An administrator needs to configure a Linux firewall using UFW (Uncomplicated Firewall) to allow incoming SSH traffic from a specific subnet (192.168.100.0/24). Which command should be executed?

What is the primary function of a Demilitarized Zone (DMZ) bastion host?

Which TWO components are standard elements of a well-designed enterprise DMZ architecture? (Choose TWO)

A network engineer is configuring an enterprise DMZ and needs to ensure proper network isolation and protection between the internet, the DMZ, and the internal corporate network. Which THREE best practices should be implemented in this architecture? (Choose three)