NSE Network Security Protocols & Technologies 3 — Questions and Answers
Question 1: Which firewall inspection technique tracks the state of active connections and only allows packets that match a known connection?
- Packet filtering
- Stateful inspection (Correct answer)
- Deep packet inspection
- Application proxy
Correct answer: Stateful inspection
Stateful inspection firewalls maintain a connection state table and verify that incoming packets belong to an established, allowed session.
Question 2: What mechanism does SSH use to protect against man-in-the-middle attacks during the initial key exchange?
- Certificate pinning via a CA
- Host key fingerprint verification (Correct answer)
- Mutual TLS authentication
- HMAC validation of the session ID
Correct answer: Host key fingerprint verification
SSH relies on the client verifying the server's host key fingerprint against a known-hosts database to detect impersonation.
Question 3: In SNMPv3, which security feature was added that was absent in SNMPv1 and SNMPv2c?
- Community strings
- MIB-II support
- User-based authentication and encryption (Correct answer)
- Trap notifications
Correct answer: User-based authentication and encryption
SNMPv3 introduced the User-based Security Model (USM), providing authentication (HMAC) and encryption (DES/AES) that earlier versions lacked.
Question 4: What is the primary security advantage of using certificate pinning in mobile applications?
- It encrypts all traffic with a stronger cipher
- It prevents the app from trusting rogue CA-signed certificates (Correct answer)
- It enables perfect forward secrecy
- It reduces TLS handshake latency
Correct answer: It prevents the app from trusting rogue CA-signed certificates
Certificate pinning hardcodes the expected certificate or public key, so the app rejects connections even if a trusted CA issues a fraudulent cert.
Question 5: Which protocol is used by FortiGate to dynamically learn and enforce role-based access policies based on user identity from an Active Directory domain controller?
- LDAP polling
- FSSO (Fortinet Single Sign-On) (Correct answer)
- SAML federation
- Kerberos ticketing
Correct answer: FSSO (Fortinet Single Sign-On)
FSSO monitors domain controller login events and maps user-to-IP associations so FortiGate can apply identity-based security policies.
Question 6: What is the key difference between IDS and IPS deployment in a network?
- IDS uses signatures while IPS uses anomaly detection
- IDS is deployed inline and blocks traffic; IPS monitors out-of-band
- IPS is deployed inline and can block threats; IDS monitors passively and only alerts (Correct answer)
- IDS inspects Layer 7; IPS inspects only Layers 3 and 4
Correct answer: IPS is deployed inline and can block threats; IDS monitors passively and only alerts
IPS sits inline in the traffic path and can actively drop malicious packets, while IDS passively monitors a copy of traffic and only generates alerts.
Question 7: Which field in the IPv6 header provides a similar security function to IPsec AH's integrity check over the fixed header fields?
- Flow Label
- Traffic Class
- Next Header
- There is no such field; IPv6 relies entirely on IPsec AH (Correct answer)
Correct answer: There is no such field; IPv6 relies entirely on IPsec AH
IPv6 itself does not natively provide integrity protection over header fields; that capability requires IPsec AH to be applied.
NSE Network Security Protocols & Technologies 3
Which firewall inspection technique tracks the state of active connections and only allows packets that match a known connection?