CCP Network Perimeter Defense 5

Question 1

An organization is evaluating whether to use a cloud-based firewall-as-a-service (FWaaS) instead of on-premises firewalls. What is the PRIMARY security consideration for distributed branch offices?

Accepted Answer

FWaaS applies consistent policy enforcement regardless of user location without backhauling traffic

Answer

FWaaS enables uniform policy enforcement at the cloud edge, eliminating the need to backhaul branch traffic to a central data center for inspection.

Question 2

Which perimeter defense strategy involves deceiving attackers with fake vulnerabilities and services to delay and study their actions?

Accepted Answer

Deception technology (honeynets)

Answer

Deception technology deploys honeynets — networks of honeypots — to lure attackers, gather intelligence, and buy time for defenders to respond.

Question 3

A company's NGFW supports TLS 1.3 inspection but employees report certificate errors. What is the MOST likely cause?

Accepted Answer

The firewall's CA certificate is not trusted by client browsers

Answer

SSL inspection requires clients to trust the firewall's re-signing CA certificate; if it's not distributed to client trust stores, browsers display certificate warnings.

Question 4

In a Zero Trust perimeter model, which statement BEST describes how access decisions are made?

Accepted Answer

Access is continuously verified using identity, device posture, and context regardless of network location

Answer

Zero Trust requires continuous verification of identity, device health, and context for every access request, rejecting the assumption that internal network location implies trust.

Question 5

Which attack specifically targets the perimeter by exploiting misconfigured firewall rules that allow traffic from a low-trust DMZ zone to reach high-trust internal zones?

Accepted Answer

DMZ to internal zone lateral movement

Answer

Misconfigured rules that permit traffic from the DMZ to internal zones allow an attacker who compromises a DMZ server to pivot directly into the trusted internal network.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Network Perimeter Defense 5