CCP Network Perimeter Defense 2 — Questions and Answers
Question 1: A security engineer wants to prevent external attackers from mapping internal IP addresses using ICMP. Which firewall rule best addresses this?
- Block all inbound ICMP echo requests at the perimeter (Correct answer)
- Block all outbound TCP port 80 traffic
- Enable NAT overload on the internal interface
- Disable ARP on the perimeter router
Correct answer: Block all inbound ICMP echo requests at the perimeter
Blocking inbound ICMP echo requests prevents external parties from using ping sweeps to discover live internal hosts.
Question 2: Which DMZ architecture places web servers between two separate firewalls with different vendors?
- Dual-homed host DMZ
- Screened subnet DMZ
- Dual-firewall DMZ (Correct answer)
- Bastion host DMZ
Correct answer: Dual-firewall DMZ
A dual-firewall DMZ uses two firewalls (often from different vendors) to isolate the DMZ, reducing the risk of a single firewall compromise exposing internal networks.
Question 3: An IPS is generating thousands of false positives, overwhelming the SOC team. What is the BEST immediate tuning action?
- Switch the IPS to detection-only mode permanently
- Increase the signature sensitivity threshold to reduce alerts
- Create exception rules for known-good traffic sources generating false alerts (Correct answer)
- Disable the IPS until the vendor releases updated signatures
Correct answer: Create exception rules for known-good traffic sources generating false alerts
Creating exception rules for verified legitimate traffic sources reduces false positives while keeping detection active for genuine threats.
Question 4: What is the primary purpose of a network access control (NAC) solution at the perimeter?
- Encrypt all traffic between network segments
- Enforce endpoint health checks before granting network access (Correct answer)
- Block all inbound connections from untrusted networks
- Manage firewall rule sets across multiple devices
Correct answer: Enforce endpoint health checks before granting network access
NAC enforces posture assessment (patch level, AV status, etc.) on endpoints before allowing them onto the network.
Question 5: A company deploys a next-generation firewall (NGFW). Which capability distinguishes it from a traditional stateful firewall?
- It inspects packets only at Layer 3
- It performs deep packet inspection including application-layer identification (Correct answer)
- It replaces the need for intrusion prevention systems entirely
- It operates exclusively on hardware appliances
Correct answer: It performs deep packet inspection including application-layer identification
NGFWs perform deep packet inspection and can identify applications regardless of port, going beyond the port/protocol focus of stateful firewalls.
Question 6: Which technique do attackers use to bypass perimeter firewalls by tunneling malicious traffic inside allowed protocols like DNS or HTTP?
- ARP spoofing
- Protocol tunneling (Correct answer)
- MAC flooding
- VLAN hopping
Correct answer: Protocol tunneling
Protocol tunneling encapsulates unauthorized traffic within permitted protocols (e.g., DNS tunneling) to evade firewall controls.
Question 7: An organization requires that all outbound web traffic be inspected for data exfiltration. Which perimeter control BEST fulfills this requirement?
- Inbound web application firewall (WAF)
- Egress filtering with a secure web gateway (SWG) (Correct answer)
- Split DNS configuration
- Network-based IDS in passive mode
Correct answer: Egress filtering with a secure web gateway (SWG)
A secure web gateway with egress filtering inspects and controls outbound HTTP/HTTPS traffic, enabling DLP and content inspection.
CCP Network Perimeter Defense 2
A security engineer wants to prevent external attackers from mapping internal IP addresses using ICMP.
Which firewall rule best addresses this?