NSE NSE Firewall & Perimeter Security 3

Question 1

What does a transparent (or bridged) firewall do differently from a routed firewall?

Accepted Answer

It inspects traffic without changing IP addresses or requiring routing changes to the network

Answer

A transparent firewall operates at Layer 2, inserting itself inline between segments without needing IP addresses on its interfaces or network topology changes.

Question 2

Which perimeter security control is BEST suited to detecting and blocking known exploit signatures in real time?

Accepted Answer

Intrusion Prevention System (IPS)

Answer

An inline IPS inspects traffic against a signature database and actively drops packets that match known exploit patterns before they reach targets.

Question 3

In NSE exam context, what does 'fail-open' mean for a perimeter security device?

Accepted Answer

If the device fails, traffic continues to flow without inspection

Answer

A fail-open device allows traffic to pass unfiltered upon failure, prioritizing availability over security — the opposite of fail-closed.

Question 4

Which type of network address translation (NAT) is commonly used to allow many internal hosts to share a single public IP address?

Accepted Answer

PAT / NAT overload (many-to-one)

Answer

PAT (Port Address Translation), also called NAT overload, maps multiple internal IP:port pairs to a single public IP using different source ports.

Question 5

What is the security risk associated with allowing 'any-to-any' rules in a firewall policy?

Accepted Answer

It eliminates all traffic restrictions, maximizing the attack surface across the network

Answer

Any-to-any rules permit all traffic between zones, effectively disabling the firewall's protective function and exposing all services to potential attack.

(NSE) Network Security Expert Practice Test

(NSE) Network Security Expert Practice Test

NSE NSE Firewall & Perimeter Security 3