NE NE Network Security 1 — Questions and Answers
Question 1: Which firewall type inspects traffic at the application layer and can filter based on application-specific data?
- Packet filter firewall
- Stateful inspection firewall
- Next-generation firewall (NGFW) (Correct answer)
- Circuit-level gateway
Correct answer: Next-generation firewall (NGFW)
NGFWs operate at Layer 7 and can identify applications regardless of port number, enabling deep packet inspection.
Question 2: What is the primary purpose of a demilitarized zone (DMZ) in network security?
- To isolate internal users from each other
- To host public-facing servers while protecting the internal network (Correct answer)
- To provide VPN termination points
- To segment wireless networks from wired networks
Correct answer: To host public-facing servers while protecting the internal network
A DMZ places public-facing servers (web, mail, DNS) in a separate zone so that even if compromised, attackers cannot directly access the internal LAN.
Question 3: Which attack floods a target with SYN packets without completing the TCP three-way handshake?
- Ping flood
- SYN flood (Correct answer)
- Smurf attack
- Teardrop attack
Correct answer: SYN flood
A SYN flood exhausts server connection tables by leaving half-open TCP sessions, resulting in a denial-of-service condition.
Question 4: What does the 802.1X standard provide in a network environment?
- VLAN tagging
- Port-based Network Access Control (NAC) (Correct answer)
- Spanning Tree Protocol
- Link aggregation
Correct answer: Port-based Network Access Control (NAC)
802.1X enforces authentication before allowing a device to access the network, requiring credentials verified by a RADIUS server.
Question 5: Which encryption protocol replaced WEP and is considered insecure due to its use of RC4?
- WPA2
- WPA3
- TKIP (WPA) (Correct answer)
- AES-CCMP
Correct answer: TKIP (WPA)
WPA with TKIP was designed as a temporary fix for WEP but still uses RC4 and has known vulnerabilities like the TKIP MIC exploit.
Question 6: What is the function of an Intrusion Prevention System (IPS) compared to an IDS?
- IPS only logs threats; IDS blocks them
- IPS actively blocks malicious traffic; IDS only detects and alerts (Correct answer)
- IPS operates out-of-band; IDS is inline
- IPS requires manual intervention; IDS is automated
Correct answer: IPS actively blocks malicious traffic; IDS only detects and alerts
An IPS sits inline in the traffic path and can drop malicious packets in real time, whereas an IDS passively monitors and generates alerts.
NE NE Network Security 1
Which firewall type inspects traffic at the application layer and can filter based on application-specific data?