CRT Network Security & Protocols 3 — Questions and Answers
Question 1: What distinguishes a stateful firewall from a stateless (packet-filter) firewall?
- It blocks all inbound traffic by default
- It tracks the state of active network connections when filtering packets (Correct answer)
- It only filters based on destination IP address
- It requires a VPN to function
Correct answer: It tracks the state of active network connections when filtering packets
A stateful firewall monitors the state of network connections and makes decisions based on context, not just individual packet headers.
Question 2: What is the purpose of a DMZ (Demilitarized Zone) in network architecture?
- To speed up internal network traffic
- To isolate publicly accessible servers from the internal private network (Correct answer)
- To encrypt all outbound traffic
- To assign static IP addresses to devices
Correct answer: To isolate publicly accessible servers from the internal private network
A DMZ places public-facing servers (web, email) in a separate network segment, limiting exposure to the internal network if those servers are compromised.
Question 3: What does NAT (Network Address Translation) primarily accomplish?
- Encrypts all outgoing packets
- Maps private internal IP addresses to one or more public IP addresses (Correct answer)
- Scans packets for malware signatures
- Assigns domain names to IP addresses
Correct answer: Maps private internal IP addresses to one or more public IP addresses
NAT allows multiple devices on a private network to share a single public IP address, also providing a layer of obscurity for internal hosts.
Question 4: What is a site-to-site VPN primarily used for?
- Providing secure internet access for individual remote users
- Connecting two entire networks securely over the public internet (Correct answer)
- Filtering malicious web content
- Scanning endpoints for vulnerabilities
Correct answer: Connecting two entire networks securely over the public internet
A site-to-site VPN creates an encrypted tunnel between two network gateways, connecting entire office networks as if they were on the same LAN.
Question 5: What is the key difference between an IDS and an IPS?
- An IDS encrypts traffic; an IPS does not
- An IDS detects and alerts on threats; an IPS can actively block them (Correct answer)
- An IPS monitors only inbound traffic; an IDS monitors only outbound
- An IDS requires hardware; an IPS is software-only
Correct answer: An IDS detects and alerts on threats; an IPS can actively block them
An Intrusion Detection System (IDS) passively monitors and alerts, while an Intrusion Prevention System (IPS) sits inline and can block malicious traffic in real time.
Question 6: Why is network segmentation considered a security best practice?
- It increases overall network speed
- It limits the lateral movement of an attacker who breaches one segment (Correct answer)
- It eliminates the need for firewalls
- It reduces the number of IP addresses needed
Correct answer: It limits the lateral movement of an attacker who breaches one segment
Segmenting a network into smaller zones (VLANs, subnets) contains breaches, preventing an attacker from freely moving between all systems.
Question 7: Which device operates at OSI Layer 3 and makes forwarding decisions based on IP addresses?
- Hub
- Switch
- Router (Correct answer)
- Repeater
Correct answer: Router
Routers operate at Layer 3 (Network layer) and use IP addresses in routing tables to forward packets between different networks.
CRT Network Security & Protocols 3
What distinguishes a stateful firewall from a stateless (packet-filter) firewall?