NSE NSE Firewall & Perimeter Security 2 — Questions and Answers
Question 1: What is the purpose of egress filtering on a perimeter firewall?
- To block inbound attacks from external networks
- To restrict unauthorized outbound traffic leaving the internal network (Correct answer)
- To inspect traffic between VLANs internally
- To perform NAT on inbound connections
Correct answer: To restrict unauthorized outbound traffic leaving the internal network
Egress filtering prevents compromised internal hosts from exfiltrating data or communicating with command-and-control servers on the internet.
Question 2: Which technology is used to allow remote users to securely traverse a perimeter firewall and access internal resources?
- VLAN trunking
- VPN (Virtual Private Network) (Correct answer)
- STP (Spanning Tree Protocol)
- OSPF routing
Correct answer: VPN (Virtual Private Network)
VPNs create an encrypted tunnel through the perimeter firewall, allowing authenticated remote users to securely access internal network resources.
Question 3: In firewall policy, what does the term 'rule shadowing' mean?
- Duplicating rules for redundancy
- A rule that can never be matched because a preceding rule already matches that traffic (Correct answer)
- Hiding rules from unauthorized administrators
- Applying rules only during off-hours
Correct answer: A rule that can never be matched because a preceding rule already matches that traffic
Rule shadowing occurs when a broader rule earlier in the policy matches all traffic intended for a more specific rule, making the specific rule unreachable.
Question 4: Which attack specifically targets the firewall's connection state table to exhaust its resources?
- Phishing
- SYN flood attack (Correct answer)
- SQL injection
- Pass-the-hash attack
Correct answer: SYN flood attack
A SYN flood sends large numbers of half-open TCP connection requests to fill the stateful firewall's connection table, causing denial of service.
Question 5: What is the role of a Web Application Firewall (WAF) compared to a network perimeter firewall?
- A WAF filters only DNS traffic
- A WAF specifically inspects HTTP/HTTPS traffic to protect web applications from Layer 7 attacks (Correct answer)
- A WAF replaces the need for a perimeter firewall
- A WAF operates exclusively at Layer 3
Correct answer: A WAF specifically inspects HTTP/HTTPS traffic to protect web applications from Layer 7 attacks
A WAF operates at the application layer to detect and block web-specific attacks such as SQL injection, XSS, and CSRF targeting web applications.
Question 6: Which of the following is a recommended best practice when managing firewall rule bases over time?
- Keep all historical rules to avoid accidental blocking
- Regularly audit and remove unused or redundant rules to reduce attack surface (Correct answer)
- Disable logging to improve firewall throughput
- Allow all internal-to-internal traffic by default
Correct answer: Regularly audit and remove unused or redundant rules to reduce attack surface
Periodic rule base audits identify and remove stale, shadowed, or unnecessary rules, reducing complexity and potential security gaps.
NSE NSE Firewall & Perimeter Security 2
What is the purpose of egress filtering on a perimeter firewall?