5.4 Review

If the primary concern is to secure against application-specific attacks, which of the following strategies should the network security engineer consider implementing?

• Deploy Layer 7 firewalls on all network edges

• Use Layer 4 firewalls for all internet-facing applications

• Rely solely on Layer 4 firewalls for internal traffic

• Deploy Layer 4 firewalls on all network edges

A company's web server is openly accessible to the internet, demanding heightened security measures. Considering the need for essential protocols and the introduction of a screened subnet, how should the company configure the firewall's access control lists (ACLs)?

• Block all ports and protocols; enable a screened subnet for the server.

• Allow all ports and protocols; do not create a screened subnet.

• Permit only FTP, SSH, and enable File Integrity Monitoring; disregard screened subnet implementation.

• Permit Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS) on firewall access control lists (ACLs); establish a screened subnet for the web server.

A cyber team implements new hardening techniques after a data loss prevention (DLP) audit revealed increased data exfiltration. What is a tenet of host-based firewalls?

• It provides controls for incoming and outgoing network traffic.

• It describes software tools that monitor and protect individual hosts.

• It uses signature-based detection and anomaly detection.

• It requires deploying and configuring specialized software agents.

A newly established e-commerce company experienced increased web-based attacks on its online shopping platform. As a result, the company installed a Web Application Firewall (WAF) to enhance its security infrastructure. What primary function should the network security manager ensure the WAF is performing to protect the online platform from the MOST common types of web-based threats, such as Cross-site Scripting (XSS), Structured Query Language (SQL) Injection, and Cross-site Request Forgery?

• Monitor traffic and block DDoS attacks

• Encrypt data in transit

• Validate input and output

• Inspect HTTPS traffic

Which of the following are features of an application-level gateway? (Select two.)

• Reassembles entire messages

• Verifies that packets are properly sequenced

• Uses access control lists

• Stops each packet at the firewall for inspection

• Allows only valid packets within approved sessions

A network security administrator's responsibilities include enhancing the enterprise's network infrastructure security posture. They deploy a Next Generation Firewall (NGFW) as part of their defense strategy. The enterprise mixes internal and external services, including a web application and a virtual private network (VPN) for remote access. Which of the following should the administrator primarily consider when implementing the NGFW to ensure effective security without disrupting normal operations?

• Deploy the NGFW in inline mode, ensuring it analyzes all traffic while maintaining connectivity.

• Position the NGFW as a jump server to manage secure access for all network services.

• Set the NGFW to operate in a fail-open mode, ensuring continuous network service even if the firewall fails.

• Use the NGFW as a load balancer, distributing network traffic across multiple servers.

A security architect designs a solution to protect the organization's network from advanced threats and provides granular access controls based on user roles. The organization has a significant volume of TLS-encrypted traffic that needs inspection and wants to integrate the solution with its network directory for role-based content filtering. Which of the following should the security architect consider the MOST appropriate option?

• A standard stateful firewall with Layer 4 filtering capabilities

• A jump server with enhanced remote access capabilities

• A Web Application Firewall (WAF) designed primarily to protect web applications from targeted attacks

• A Next Generation Firewall (NGFW) with Layer 7 application-aware filtering and intrusion prevention system (IPS) functionality

The chief information security officer (CISO) at a medium-sized healthcare company conducts an audit of the company's current security infrastructure. The company has Next Generation Firewalls (NGFWs) deployed at all external network boundaries, and the CISO is evaluating the possibility of supplementing or replacing the NGFWs with Unified Threat Management (UTM) devices. If the primary concern is to increase the network's security without introducing significant management complexity, which of the following strategies should the CISO consider implementing?

• Replace all NGFWs with UTM devices.

• Deploy UTM devices alongside the NGFWs, with both sets of devices fully active.

• Implement UTM devices internally and maintain NGFWs at network boundaries.

• Switch off NGFWs and deploy UTM devices, but only activate UTM when detecting a threat.

Jessica needs to set up a firewall to protect her internal network from the internet. Which of the following would be the BEST type of firewall for her to use?

• Hardware

• Software

• Stateful

• Tunneling

Which of the following describes the placement and role of a firewall in a network with a defense-in-depth strategy?

• A. A firewall is typically on internal routers and serves as a corrective control to mitigate denial-of-service (DoS) attacks.

• B. A firewall is typically inline behind the border firewall and serves as a preventive control to enforce access rules.

• C. A firewall is typically at the network border and serves as a detective control to identify malicious traffic.

• D. A firewall is typically at the network border and serves as a preventive control to enforce access rules for ingress and egress traffic.