CompTIA Network+ Network+ Network Security Hardening 3

Question 1

Which type of ACL is applied closest to the traffic source to block unwanted packets as early as possible?

Accepted Answer

Extended ACL applied inbound at the source

Answer

Extended ACLs match both source and destination so they are most efficient when applied inbound at the source router interface.

Question 2

A security engineer wants to detect and block rogue DHCP servers on a network. Which switch feature accomplishes this?

Accepted Answer

DHCP snooping

Answer

DHCP snooping marks ports as trusted or untrusted; DHCP offers from untrusted ports are dropped, preventing rogue servers.

Question 3

Which hardening action should be taken for unused switch ports to prevent unauthorized device connections?

Accepted Answer

Shut them down and assign them to an unused VLAN

Answer

Administratively shutting down unused ports and moving them to an isolated VLAN prevents any unauthorized device from gaining network access.

Question 4

A network team deploys a host-based firewall on every server in the data center. This is an example of which security principle?

Accepted Answer

Defense in depth

Answer

Defense in depth uses multiple overlapping security layers (perimeter firewall plus host firewall) so that bypassing one layer doesn't grant full access.

Question 5

What is the function of IP Source Guard on a switch port?

Accepted Answer

Filters packets so only traffic matching the DHCP snooping binding table is forwarded

Answer

IP Source Guard uses the DHCP snooping binding table to drop packets whose source IP or MAC doesn't match the recorded lease, stopping IP spoofing.

CompTIA Practice Test

CompTIA Practice Test

CompTIA Network+ Network+ Network Security Hardening 3