SE Network Security 1 — Questions and Answers
Question 1: Which firewall type inspects traffic at the application layer and understands specific protocols like HTTP and FTP?
- Packet-filtering firewall
- Stateful inspection firewall
- Application-layer (proxy) firewall (Correct answer)
- Circuit-level gateway
Correct answer: Application-layer (proxy) firewall
Application-layer firewalls (proxies) operate at Layer 7 and can inspect and filter protocol-specific content.
Question 2: What is the primary purpose of network segmentation in a security architecture?
- Increase bandwidth
- Limit lateral movement and contain breaches (Correct answer)
- Simplify network management
- Reduce hardware costs
Correct answer: Limit lateral movement and contain breaches
Network segmentation restricts an attacker's ability to move laterally across the environment after an initial compromise.
Question 3: A security engineer needs to detect unauthorized devices connecting to a wired network. Which technology provides the best control?
- MAC address filtering
- Network Access Control (NAC) (Correct answer)
- VLAN tagging
- Port mirroring
Correct answer: Network Access Control (NAC)
NAC enforces policy-based access, performing posture checks before granting network admission.
Question 4: Which attack exploits a weakness in the ARP protocol to intercept traffic between two hosts on the same network?
- DNS poisoning
- BGP hijacking
- ARP spoofing (poisoning) (Correct answer)
- ICMP redirect attack
Correct answer: ARP spoofing (poisoning)
ARP spoofing sends forged ARP replies to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.
Question 5: What does a network-based IDS (NIDS) primarily analyze to detect threats?
- Host log files
- Memory dumps
- Network packet traffic (Correct answer)
- User authentication events
Correct answer: Network packet traffic
A NIDS passively monitors and analyzes network traffic flows to detect suspicious patterns or signatures.
Question 6: Which protocol provides encrypted tunneling for site-to-site VPN connections commonly used in enterprise environments?
- PPTP
- L2TP alone
- IPsec (Correct answer)
- Telnet
Correct answer: IPsec
IPsec provides authentication and encryption at the IP layer and is the standard for secure site-to-site VPN tunnels.
SE Network Security 1
Which firewall type inspects traffic at the application layer and understands specific protocols like HTTP and FTP?