CCP Network Perimeter Defense 3 — Questions and Answers
Question 1: Which firewall rule processing model evaluates rules from top to bottom and stops at the first match?
- Best-match processing
- First-match processing (Correct answer)
- Last-match processing
- Weighted-match processing
Correct answer: First-match processing
Most firewalls use first-match (top-down) processing, so rule order is critical — more specific rules must appear before broader ones.
Question 2: A penetration tester discovers that the company's firewall allows all outbound traffic on port 443. Which attack vector does this MOST enable?
- SYN flood attacks against internal servers
- Command-and-control communications using HTTPS tunneling (Correct answer)
- ARP poisoning of the default gateway
- Brute-force attacks against the firewall management interface
Correct answer: Command-and-control communications using HTTPS tunneling
Unrestricted outbound HTTPS allows malware to use port 443 for encrypted C2 communication, blending with legitimate web traffic.
Question 3: What is the role of a reverse proxy in perimeter defense?
- It routes outbound client requests to external servers anonymously
- It sits in front of internal servers and forwards external client requests to them (Correct answer)
- It encrypts traffic between two internal network segments
- It provides VPN connectivity for remote users
Correct answer: It sits in front of internal servers and forwards external client requests to them
A reverse proxy accepts inbound connections on behalf of backend servers, hiding internal server details and enabling inspection or load balancing.
Question 4: An organization uses geolocation-based IP blocking at the perimeter. What is a significant limitation of this control?
- It prevents all insider threats from exfiltrating data
- Attackers can bypass it using VPNs or proxy servers in allowed regions (Correct answer)
- It only works with IPv6 addresses
- It requires a dedicated hardware appliance to function
Correct answer: Attackers can bypass it using VPNs or proxy servers in allowed regions
Geolocation blocking can be easily circumvented by routing traffic through a VPN exit node or proxy located in a permitted country.
Question 5: Which of the following BEST describes the function of a honeypot in perimeter defense?
- It filters malicious traffic before it reaches production systems
- It acts as a decoy system to detect and study attacker behavior (Correct answer)
- It encrypts all perimeter traffic using asymmetric keys
- It provides redundancy for the primary firewall
Correct answer: It acts as a decoy system to detect and study attacker behavior
A honeypot is a decoy resource that attracts attackers, enabling defenders to detect intrusions and analyze attack techniques without risk to real assets.
Question 6: During a firewall audit, you find a rule that allows ANY source to reach ANY destination on ANY port. What should be done FIRST?
- Document the rule and schedule a review for next quarter
- Immediately remove the rule without further analysis
- Identify the business justification for the rule before modifying it (Correct answer)
- Replace it with a rule allowing only TCP traffic
Correct answer: Identify the business justification for the rule before modifying it
Before modifying or removing any firewall rule, you must determine whether it supports a legitimate business function to avoid unintended service disruptions.
Question 7: Which perimeter defense technology creates an encrypted tunnel between a remote user and the corporate network, extending the trusted perimeter?
- VLAN segmentation
- Virtual Private Network (VPN) (Correct answer)
- Port-based NAC
- Web application firewall
Correct answer: Virtual Private Network (VPN)
A VPN establishes an encrypted tunnel that allows remote users to securely access internal resources as if they were on the corporate network.
CCP Network Perimeter Defense 3
Which firewall rule processing model evaluates rules from top to bottom and stops at the first match?