Q1. A cybersecurity analyst is reviewing firewall logs and notices a recurring pattern of external IP addresses attempting to connect to internal web servers on non-standard ports. These connection attempts are being blocked by the firewall. The analyst suspects these attempts are reconnaissance for potential exploitation. What is the MOST appropriate action to take to further enhance security against these types of threats?
-
Install a Web Application Firewall (WAF) to inspect and filter HTTP/HTTPS traffic.
-
Implement port knocking on the internal web servers to restrict access to authorized users.
-
Update the firewall's intrusion detection/prevention signatures to include specific attack patterns. ✓ Correct
-
Configure static NAT entries for the internal web servers to present only necessary ports to the internet.
Why: The firewall is already blocking these attempts, indicating a perimeter defense is in place. However, the recurring nature of these attempts suggests that the attackers are persistent. Updating the IPS signatures on the firewall allows it to actively identify and block the specific techniques or known malicious IP addresses associated with this reconnaissance, going beyond simple port blocking. A WAF is excellent for protecting web applications from layer 7 attacks but might be overkill if the issue is purely reconnaissance at the network layer, and it doesn't directly address the *detection* of the reconnaissance itself. Port knocking is a method to dynamically open ports and is generally used for very high-security scenarios, adding complexity and potentially impacting legitimate traffic if not managed perfectly. Configuring static NAT is standard practice and doesn't inherently prevent reconnaissance attempts; the firewall rules are what provide the protection.
Q2. A company has recently suffered a ransomware attack that encrypted several critical file servers. Forensics indicate the initial infection vector was a phishing email clicked by an employee. The IT security team wants to implement a control to prevent similar incidents from causing widespread data loss in the future. Which of the following controls would be the MOST effective mitigation strategy for preventing data loss from ransomware?
-
Deploy endpoint detection and response (EDR) solutions on all workstations and servers.
-
Implement regular, automated, and offsite backups of critical data. ✓ Correct
-
Conduct mandatory security awareness training for all employees.
-
Strengthen email filtering and anti-phishing measures at the gateway.
Why: While EDR, security awareness training, and enhanced email filtering are crucial for preventing attacks, a robust backup strategy is the ultimate safeguard against data loss from ransomware. If data is encrypted, having recent, verified, and isolated backups allows for rapid recovery without paying a ransom. EDR can help detect and stop the ransomware, and training/filtering can prevent initial infection, but none guarantee complete data preservation if the initial infection is successful and spreads. Backups provide the last line of defense specifically against the data destruction aspect of ransomware.
Q3. A network engineer is designing a secure network for a sensitive research department. This department handles proprietary data, and access needs to be strictly controlled. The department is located in a physically separate building from the main corporate network. What is the BEST approach to ensure the highest level of security and data confidentiality for this department's network?
-
Implement a separate, air-gapped network for the research department. ✓ Correct
-
Use a dedicated VPN tunnel with strong encryption between the research department's network and the main corporate network.
-
Configure strict firewall rules and VLANs to segment the research department's network from the rest of the organization.
-
Deploy a Zero Trust Network Access (ZTNA) solution for all devices within the research department.
Why: An air-gapped network is physically isolated and has no direct connection to any other network, including the internet or the corporate network. This provides the highest level of security against external threats and insider data exfiltration attempts for extremely sensitive data. While a dedicated VPN, strict firewall rules/VLANs, and ZTNA are valuable security measures, they all rely on some form of connectivity that an air gap eliminates. A VPN still traverses a network, firewalls and VLANs segment but don't inherently disconnect, and ZTNA assumes a network fabric exists for devices to connect to.
Q4. During a security audit, it was discovered that an employee in the accounting department has been using a personal USB drive to transfer large financial reports between their work computer and their home computer. This practice bypasses corporate security controls and introduces risks of data leakage and malware infection. What is the MOST effective technical control to prevent this type of unauthorized data transfer via removable media?
-
Implement a robust endpoint detection and response (EDR) solution.
-
Configure host-based firewalls on all workstations to block USB storage devices.
-
Deploy Data Loss Prevention (DLP) software with policies to control or block removable media usage. ✓ Correct
-
Enforce strong password policies for all user accounts.
Why: DLP solutions are specifically designed to monitor and control the movement of sensitive data. By configuring DLP policies, administrators can block the use of USB storage devices entirely, restrict their use to specific authorized devices, or scan data transferred to them for policy violations. While EDR can detect malware introduced via USB, it doesn't prevent the transfer itself. Host-based firewalls typically don't have granular control over USB device types for storage. Strong password policies are essential for account security but do not directly prevent the physical transfer of data via unauthorized hardware.
Q5. A financial institution needs to ensure that sensitive customer data transmitted between its web servers and clients is protected from eavesdropping and tampering. The company wants to implement a solution that provides encryption and authentication for these communications at the transport layer. Which of the following protocols should be configured on the web servers?
-
SSL/TLS ✓ Correct
-
SFTP
-
Kerberos
-
RADIUS
Why: SSL/TLS (Secure Sockets Layer/Transport Layer Security) is the standard protocol used to encrypt and authenticate communications between web servers and clients (e.g., HTTPS). It provides confidentiality by encrypting the data and integrity by ensuring the data hasn't been tampered with, and authentication of the server (and optionally the client). SFTP (SSH File Transfer Protocol) is used for secure file transfers, not general web traffic. Kerberos and RADIUS are authentication protocols, not primarily designed for encrypting the content of web traffic itself, though they might be used in conjunction with secure web access.
Q6. A network administrator is tasked with securing a newly deployed wireless network. An audit has revealed that the previous wireless network was using WEP encryption, which has been compromised. The administrator needs to implement the strongest available wireless encryption standard to protect against unauthorized access and data interception. Which of the following should be implemented?
-
WPA2-PSK (Wi-Fi Protected Access 2 - Pre-Shared Key)
-
WPA3-Enterprise (Wi-Fi Protected Access 3 - Enterprise) ✓ Correct
-
WPA (Wi-Fi Protected Access)
-
WEP (Wired Equivalent Privacy)
Why: WPA3 is the latest and most secure wireless security protocol. WPA3-Enterprise offers enhanced security features over WPA2-Enterprise, including stronger encryption (GCMP-256), protection against dictionary attacks, and individualized data encryption even on open networks. While WPA2-PSK is a significant improvement over WEP and WPA, WPA3 represents the current best practice. WPA is an older standard that has known vulnerabilities and should not be used. WEP is completely insecure and deprecated.
Q7. A cybersecurity team is investigating a series of sophisticated phishing attacks targeting executives within a large financial institution. The attackers are spoofing internal email addresses and using zero-day exploits within document attachments to gain initial access. To mitigate the risk of future successful attacks, which security control should be implemented as a FIRST step at the network perimeter?
-
Deploying an Intrusion Prevention System (IPS) with up-to-date signature files. ✓ Correct
-
Implementing a strict egress filtering policy on the edge router.
-
Configuring a Web Application Firewall (WAF) for all internal web servers.
-
Enforcing a mandatory two-factor authentication (2FA) for all remote access VPN connections.
Why: The correct answer is Deploying an Intrusion Prevention System (IPS) with up-to-date signature files. The scenario describes attacks utilizing zero-day exploits within attachments, which an IPS is designed to detect and block based on known attack patterns and heuristics, even for previously unseen variations. Implementing a strict egress filtering policy is important for preventing data exfiltration, but it does not directly address the initial infection vector. Configuring a WAF is relevant for web application security, not for blocking malicious email attachments. Enforcing 2FA for VPNs is a crucial security measure, but it secures remote access, not the email-borne threat described.
Q8. A company operates a hybrid cloud environment with sensitive financial data stored on-premises and customer-facing applications hosted in a public cloud. The on-premises network contains multiple server segments, including HR, R&D, and Finance. Network security policies dictate that only specific application servers in the Finance segment should be able to access the cloud-hosted financial applications, and no other segments should have access to the Finance segment at all. Which network security implementation BEST addresses these requirements at the internal network boundary between segments?
-
Deploying a next-generation firewall (NGFW) between the cloud environment and the on-premises data center.
-
Implementing VLANs to logically separate the server segments and configuring Access Control Lists (ACLs) on the inter-VLAN routing device. ✓ Correct
-
Utilizing a Software-Defined Networking (SDN) controller to enforce micro-segmentation policies across the entire infrastructure.
-
Establishing a VPN tunnel between the on-premises Finance segment and the cloud-hosted financial applications.
Why: The correct answer is Implementing VLANs to logically separate the server segments and configuring Access Control Lists (ACLs) on the inter-VLAN routing device. VLANs provide Layer 2 segmentation, and ACLs applied to the router performing inter-VLAN routing enforce granular traffic control between these segments, directly meeting the requirement of isolating the Finance segment and allowing specific access to cloud applications. Deploying an NGFW at the perimeter secures the boundary between on-premises and cloud but doesn't inherently manage internal segment-to-segment traffic as effectively or cost-efficiently as internal ACLs. While SDN and micro-segmentation (option C) could achieve this, it's often a more complex and expensive solution than traditional VLANs and ACLs for established internal segmentation needs. A VPN tunnel (option D) is primarily for secure communication over untrusted networks, not for internal network segmentation and access control between internal segments.
Q9. A network engineer is deploying 802.1X on the corporate wired network. Employee laptops authenticate successfully, but the company also has network printers and IP cameras that lack any supplicant software and cannot present credentials. The engineer must allow these devices onto the network without leaving open ports that any device could use. Which approach BEST meets this requirement?
-
Configure MAC Authentication Bypass (MAB) as a fallback method on the switch ports for the non-802.1X devices ✓ Correct
-
Disable 802.1X on the switch ports connected to printers and cameras and rely on physical port labeling
-
Place all printers and cameras on the native VLAN and trust them implicitly
-
Enable open authentication with a captive portal for the printers and cameras
Why: MAB allows the switch to authenticate devices by their MAC address against a RADIUS server when they cannot perform 802.1X, providing a controlled onboarding path for headless devices while still enforcing port-based access control. Disabling 802.1X entirely removes the access control and leaves the ports open to any device, defeating the security goal. Placing devices on the native VLAN and trusting them implicitly provides no authentication and expands attack surface. A captive portal requires user interaction through a browser, which headless printers and cameras cannot perform, so it is not viable for these devices.
Q10. A security architect is designing segmentation for a data center that hosts a three-tier web application (web, application, and database tiers) on the same physical hypervisors. The requirement is to restrict lateral traffic so that only explicitly permitted flows between tiers are allowed, even for VMs residing on the same host. Which control BEST satisfies this requirement?
-
Microsegmentation using host-based/hypervisor distributed firewall policies ✓ Correct
-
A single perimeter firewall at the data center edge with a deny-all inbound rule
-
Placing all three tiers in one VLAN protected by a strong ACL on the core router
-
Port security limiting the number of MAC addresses on each hypervisor uplink
Why: Microsegmentation enforces granular, per-workload policy at the hypervisor level, controlling east-west traffic between VMs even when they share the same physical host, which is exactly the lateral movement concern described. A perimeter firewall only inspects north-south traffic entering or leaving the data center and cannot see traffic between VMs on the same host. Putting all tiers in one VLAN with a router ACL fails because intra-VLAN traffic never reaches the router to be filtered. Port security limits MAC addresses to prevent flooding/spoofing but does nothing to control application-tier flows between servers.