CCP Network Perimeter Defense 2

Question 1

A security engineer wants to prevent external attackers from mapping internal IP addresses using ICMP. Which firewall rule best addresses this?

Accepted Answer

Block all inbound ICMP echo requests at the perimeter

Answer

Blocking inbound ICMP echo requests prevents external parties from using ping sweeps to discover live internal hosts.

Question 2

Which DMZ architecture places web servers between two separate firewalls with different vendors?

Accepted Answer

Dual-firewall DMZ

Answer

A dual-firewall DMZ uses two firewalls (often from different vendors) to isolate the DMZ, reducing the risk of a single firewall compromise exposing internal networks.

Question 3

An IPS is generating thousands of false positives, overwhelming the SOC team. What is the BEST immediate tuning action?

Accepted Answer

Create exception rules for known-good traffic sources generating false alerts

Answer

Creating exception rules for verified legitimate traffic sources reduces false positives while keeping detection active for genuine threats.

Question 4

What is the primary purpose of a network access control (NAC) solution at the perimeter?

Accepted Answer

Enforce endpoint health checks before granting network access

Answer

NAC enforces posture assessment (patch level, AV status, etc.) on endpoints before allowing them onto the network.

Question 5

A company deploys a next-generation firewall (NGFW). Which capability distinguishes it from a traditional stateful firewall?

Accepted Answer

It performs deep packet inspection including application-layer identification

Answer

NGFWs perform deep packet inspection and can identify applications regardless of port, going beyond the port/protocol focus of stateful firewalls.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Network Perimeter Defense 2