NSE Firewall & Perimeter Security Flashcards

What does a transparent (or bridged) firewall do differently from a routed firewall?

Answer: It inspects traffic without changing IP addresses or requiring routing changes to the network

A transparent firewall operates at Layer 2, inserting itself inline between segments without needing IP addresses on its interfaces or network topology changes.

Which perimeter security control is BEST suited to detecting and blocking known exploit signatures in real time?

Answer: Intrusion Prevention System (IPS)

An inline IPS inspects traffic against a signature database and actively drops packets that match known exploit patterns before they reach targets.

In NSE exam context, what does 'fail-open' mean for a perimeter security device?

Answer: If the device fails, traffic continues to flow without inspection

A fail-open device allows traffic to pass unfiltered upon failure, prioritizing availability over security — the opposite of fail-closed.

Which type of network address translation (NAT) is commonly used to allow many internal hosts to share a single public IP address?

Answer: PAT / NAT overload (many-to-one)

PAT (Port Address Translation), also called NAT overload, maps multiple internal IP:port pairs to a single public IP using different source ports.

What is the security risk associated with allowing 'any-to-any' rules in a firewall policy?

Answer: It eliminates all traffic restrictions, maximizing the attack surface across the network

Any-to-any rules permit all traffic between zones, effectively disabling the firewall's protective function and exposing all services to potential attack.

Which method is used by administrators to securely manage firewall devices without exposing management traffic to production networks?

Answer: Configuring an out-of-band (OOB) management network

Out-of-band management networks physically separate management traffic from production traffic, preventing attackers with production network access from reaching management interfaces.