CISA Network and Infrastructure Security

Question 1

Which network security device inspects packet headers and filters traffic based on predefined rules without examining packet content?

Accepted Answer

Packet-filtering firewall

Answer

Stateful firewall

Answer

Intrusion Detection System

Answer

Web application firewall

Question 2

A CISA auditor reviewing network segmentation should PRIMARILY verify that:

Accepted Answer

Critical systems are isolated in separate network zones

Answer

All systems reside on a single flat network

Answer

Wireless and wired networks share the same subnet

Answer

Firewalls are only deployed at the network perimeter

Question 3

Which protocol provides encrypted remote administration of network devices and is preferred over Telnet?

Accepted Answer

SSH

Answer

SNMP v2

Answer

FTP

Answer

HTTP

Question 4

An Intrusion Prevention System (IPS) differs from an IDS primarily because an IPS can:

Accepted Answer

Actively block or drop malicious traffic in real time

Answer

Generate alerts for suspicious activity

Answer

Log network traffic for forensic analysis

Answer

Perform vulnerability scans on endpoints

Question 5

During a network audit, an IS auditor finds that SNMP v1 is still in use. The PRIMARY concern is:

Accepted Answer

SNMP v1 community strings are transmitted in plaintext

Answer

SNMP v1 uses too much bandwidth

Answer

SNMP v1 does not support IPv6

Answer

SNMP v1 cannot monitor router interfaces

Question 6

A DMZ (Demilitarized Zone) is BEST described as:

Accepted Answer

A network zone between the internet and the internal network that hosts public-facing services

Answer

A segment where only internal users can access resources

Answer

A backup network used only during disaster recovery

Answer

A VLAN reserved for administrative management traffic