Network Security Controls Protocols And Devices

A network administrator is configuring an intrusion prevention system (IPS) and needs to understand how signature-based and anomaly-based detection engines operate. Which TWO statements accurately describe anomaly-based IPS detection? (Choose two)

An organization is designing a redundant network architecture to prevent single points of failure at the gateway level. Which THREE protocols or features are commonly used to provide gateway redundancy and high availability for default routers or firewalls? (Choose three)

A corporate network is segmented into multiple zones. The security policy dictates that the Finance department subnet must be completely isolated from the Guest Wi-Fi subnet, and traffic between them must pass through a security device enforcing access control lists. Where should this security device be placed?

An organization wants to protect internal workstations by deploying a host-based firewall that evaluates inbound and outbound connection requests based on application executable names rather than just IP addresses and port numbers. Which Windows built-in security feature provides this capability?

A security engineer needs to configure secure log management and transmission from edge firewalls and switches to a centralized SIEM server. Which TWO protocols or features ensure that log data is transmitted securely and integrally across the network? (Choose two)

An enterprise is deploying an IPsec site-to-site VPN. The security team wants to ensure that if an attacker captures today's encrypted network traffic, they cannot decrypt it even if they eventually compromise the long-term preshared keys or private keys used during the initial key exchange. What cryptographic property must be enforced?

An organization is deploying an Intrusion Prevention System (IPS) in an enterprise data center. To minimize latency and avoid becoming a single point of failure that disrupts network uptime if the hardware fails, the engineering team chooses a specific deployment topology. Which deployment option provides inline inspection with hardware-level bypass capability?

A security architect is designing network access control for a campus LAN. The requirement is to authenticate users and devices, assign VLANs dynamically based on identity, and quarantine non-compliant endpoints before granting production access. Which combination of protocols and features should the architect implement?

An enterprise network security team is analyzing BGP routing anomalies at the internet edge. An attacker is attempting to inject malicious routing updates to hijack corporate IP space (BGP prefix hijacking). Which mechanism should the network edge routers implement to cryptographically verify the origin autonomy of IP prefixes?

A network administrator needs to deploy a security device that inspects inbound HTTP and HTTPS traffic at the application layer and drops requests containing SQL injection signatures before they reach the web server. Which device should the administrator deploy?

An enterprise security architect is designing a Zero Trust network segmentation model. Which THREE core principles are foundational to Zero Trust architecture regarding network access and device verification? (Choose three)

A network engineer is configuring an OpenVPN server in TUN mode for remote workers. What is the fundamental characteristic of TUN mode compared to TAP mode regarding network layer operation?

A security analyst observes that an internal host is generating excessive DNS queries containing encoded data within subdomains, indicative of a DNS tunneling attack. The network perimeter firewall allows outbound DNS traffic on UDP port 53 to any external IP. Which network security control should be implemented to mitigate this threat?

A network engineer is configuring TLS 1.3 on an enterprise load balancer. During cipher suite selection, the engineer observes that cipher suites like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 are no longer listed in the configuration menu. What is the primary reason for this change in TLS 1.3?

A security engineer is tasked with restricting network access to a sensitive database server so that only the application server VLAN can communicate with it on TCP port 1433. The database server is hosted on a virtualized hypervisor switch. Where should this micro-segmentation control be implemented for optimal enforcement?

A security engineer is evaluating a network intrusion prevention system (NIPS) that must inspect traffic flowing between two internal VLANs at 10 Gbps. The requirement is to detect and block exploits without introducing asymmetric routing, and the device must remain transparent to Layer 2 and Layer 3 topologies. Which deployment mode should the engineer choose?

A network engineer is configuring IPsec site-to-site VPN policies. During Phase 2 negotiations, which TWO parameters must match identically on both VPN peers for the security association (SA) to establish successfully? (Choose two)

A security analyst is investigating a compromised network segment and discovers that an attacker bypassed network perimeter access controls by tunneling malicious command-and-control traffic through allowed protocols. Which THREE protocols are most commonly abused for covert data exfiltration and tunneling through corporate firewalls? (Choose three)

A network administrator is setting up a secure remote management channel for Linux servers across the public internet. The security policy mandates that Telnet must not be used. Which protocol should be implemented?

A network administrator is configuring a high-availability pair of firewalls in active/passive mode using virtual router redundancy protocol (VRRP). During a failover event, active TCP sessions drop, forcing users to re-authenticate to internal applications. Which firewall feature must be enabled to maintain stateful session continuity across the failover?

A security architect is designing a high-security DMZ architecture. Public-facing web servers must be isolated from the internal database servers, and an intermediary inspection zone is required. Which design pattern should the architect implement?

A security engineer is configuring a Next-Generation Firewall (NGFW) to perform deep packet inspection (DPI) on encrypted TLS traffic. Due to privacy regulations, specific internal banking applications must be excluded from SSL decryption. How should the engineer configure the firewall to bypass decryption for these specific destinations without disabling overall inspection?

A network administrator is implementing defense-in-depth measures against ARP spoofing and man-in-the-middle attacks on a Cisco switched enterprise network. Which THREE switch security features should be enabled on access layer ports? (Choose three)

A security team is conducting a penetration test against a corporate network and attempts a Man-in-the-Middle (MitM) attack using ICMP redirection and IPv6 Router Advertisement (RA) spoofing. Which THREE network controls effectively mitigate these specific local network redirection attacks? (Choose three)

A network administrator is configuring secure remote access for employees. The security policy mandates that the remote access solution must support multi-factor authentication (MFA) and encrypt all traffic from the client device. Which TWO technologies or protocols can meet these requirements? (Choose two)

An enterprise network uses an Intrusion Detection System (IDS) deployed in passive monitoring mode via a switch span port. The security operations center (SOC) notices that the IDS generates high volumes of alerts for internal vulnerability scanning activities, obscuring real attacks. Which network design modification should be implemented to reduce false positive alert fatigue without disabling the detection signatures?

An organization's security policy requires that all remote workers connect to the corporate network via a VPN that routes all client internet traffic through the corporate data center security stack. Which type of VPN architecture must the remote client be configured to use?

An organization wants to deploy a wireless intrusion prevention system (WIPS) sensor to detect unauthorized access points and rogue devices broadcasting corporate SSIDs. Where should the WIPS sensor be deployed?

An organization implements IEEE 802.1X port-based authentication across its enterprise switch infrastructure. A new IP security camera is connected to a switch port, but it does not support 802.1X supplicant software. How should the network administrator configure the switch port to authenticate and isolate the camera securely?

An enterprise network uses VLANs to separate departments. Users in the Marketing VLAN need to access a printer located in the Sales VLAN. Which network device is strictly required to route traffic between these two distinct VLANs?

An administrator needs to secure SNMP traffic on enterprise network switches so that management queries and responses are both encrypted and authenticated. Which version of SNMP must be configured?

A security engineer is performing a security audit of an enterprise firewall and discovers several misconfigurations. Which THREE of the following practices represent severe security vulnerabilities in firewall deployment? (Choose three)