Module 9

Which of the following best describes DLP?

• DLP is used to control access to digital assets.
• DLP is a protocol used to transfer data within switches.
• DLP is used to prevent leakage of confidential data.
• DLP is a VPN protocol.

Answer explanation

DLP is used to prevent the leakage of confidential data.

In an interview, you are asked to analyze the following statements regarding secure network designs and choose the correct one. Which of the following should you choose?

• Zero trust is designed to make a system trusted.
• Workgroup switches reside at the top of the hierarchy and carry traffic between switches.
• Switches can transfer packets when VLAN members on one switch need to communicate with members connected to another switch.
• Load balancers can detect and stop protocol attacks directed at a server or application.

Answer explanation

Load balancers can detect and stop protocol attacks directed at a server or application.

In an interview, Max was asked to tell one difference between a software firewall and a virtual firewall. How should Max answer?

• Software firewalls are locally installed on a device, whereas virtual firewalls run in the cloud.
• Virtual firewalls are cost-free, whereas software firewalls are paid services.
• Software firewalls can protect all the endpoints in a network, whereas virtual firewalls can protect only one device.
• Virtual firewalls are used on almost all devices, whereas software firewalls are mostly used by enterprises.

Answer explanation

Software firewalls are locally installed on a device, whereas virtual firewalls are hosted on the cloud.

Which of the following outlines the process of a proxy server?

• User - internet - reverse proxy - forward proxy - user
• User - forward proxy - Internet - reverse proxy - user
• User - reverse proxy - Internet - forward proxy - user
• User - forward proxy - user - reverse proxy - Internet

Answer explanation

The traffic from the user is first intercepted by the forward proxy. The forward proxy then connects to the internet, and the data is sent to the reverse proxy. The reverse proxy then sends the data to the user.

How do NACs ensure that a device is safe to connect to a secure network?

• The NAC encrypts all of the data on an unknown device before connecting it to the secured network.
• The NAC issues a health certificate, only allowing healthy devices to connect to the secured network.
• The NAC ensures the safety of the device by deleting all suspicious files.
• The NAC moves suspicious data on an unknown device onto an external storage device.

Answer explanation

A network access control (NAC) issues a health certificate after analyzing the device, and the device can connect to the secure network only if it has good health.

Sansa is a network security administrator at an enterprise. She is asked to take appropriate steps to defend against a MAC address spoofing attack in the enterprise network. Which of the following methods should Sansa apply?

• Configure the switch so that no changes can be done once a port is assigned to a MAC address
• Increase the capacity of CAM to allow for an increased volume of MAC addresses
• Close all unused ports in the switch so that old MAC addresses are not allowed
• Configure the switch so that only one port can be assigned per MAC address

Answer explanation

To prevent MAC address spoofing, you should configure the switch so that only one port can be assigned per MAC address.

Which monitoring methodology will trigger the IDS if any application tries to scan multiple ports?

• Signature-based monitoring
• Heuristic monitoring
• Anomaly-based monitoring
• Behavior-based monitoring

Answer explanation

Heuristic monitoring triggers the IDS if any application tries to scan multiple ports.

In a security review meeting, you are asked to take appropriate security measures to mitigate IP spoofing attacks against the enterprise network. Which of the following methods should you apply?

• You should set up a proxy server.
• You should set up an ACL.
• You should set up a VPN.
• You should set up a DLP.

Answer explanation

Setting an access control list (ACL) can prevent IP spoofing attacks as it can block unused and untrusted addresses.

The head of cybersecurity at your enterprise has asked you to set up an IDS that can create the baseline of all system activities and raise an alarm whenever any abnormal activities take place, without waiting to check the underlying cause. Which of the following actions should you take?

• You should set up an IDS with behavior-based monitoring methodology.
• You should set up an IDS with heuristic monitoring methodology.
• You should set up an IDS with anomaly-based monitoring methodology.
• You should set up an IDS with signature-based monitoring methodology.

Answer explanation

Anomaly-based monitoring creates a baseline, and whenever a slight deviation occurs in the activity, an alarm is raised.

Which of the following is associated with port security?

• Tokenization
• Masking
• Spanning-tree protocol
• Split tunnel

Answer explanation

The spanning-tree protocol (STP) helps a switch find the right path to its destination by preventing looping.