New devices were deployed on a network and need to be hardened. The network contains a cloud network (SQL server, web server and Linux server), a firewall, a switch, a wireless controller, a workstation, two wireless access points (WAP-1 and WAP-2) and user accounts.
For each device, select the appliance-hardening technique that provides the most secure solution.
Explanation
On the SQL server, role-based access control with least privilege limits who can read or change data; blocking port 1433 would break the database service and enabling all services widens the attack surface. On the web server, enforcing TLS 1.3 protects the traffic users send, while basic authentication and disabling HTTPS weaken it. On the Linux server, disabling direct root access forces administrators to use individual accounts and privilege escalation; disabling SELinux removes a protection. On the firewall, limiting administrative access to its management interfaces keeps attackers away from the device that enforces policy; an implicit allow posture is the opposite of the default-deny rule a firewall should apply, and disabling remote management or SSH would cut off secure administration. On the switch, disabling unused ports stops anyone from plugging in an unauthorized device. On the wireless controller, a RADIUS server gives centralized 802.1X authentication instead of local log-ins or default SNMP communities. On the workstation, enabling OS updates keeps it patched, whereas VNC and remote management add exposure. On WAP-2, MAC filtering is the only option that restricts access (SSLv2 is broken and bridge mode is not a control). For user accounts, password complexity strengthens credentials, while the other choices weaken them. On WAP-1, WPA3 is the current strongest Wi-Fi security; 802.11b is obsolete.
You are designing a campus network with a three-tier hierarchy and need to ensure secure connectivity between locations and traveling employees. The diagram shows an egress zone (Internet and WAN routers, firewalls, anti-DDoS), a data center, a branch campus and the campus switching tiers. The command output from the hosts is:
| Host | IPv4 address | Subnet mask | Default gateway |
|---|---|---|---|
| Data center server | 10.31.2.5 | 255.255.255.0 | 10.31.2.1 |
| Branch campus laptop | 10.31.10.5 | 255.255.255.0 | 10.31.10.1 |
| Workstation 1 | 10.31.5.5 | 255.255.255.0 | 10.31.5.1 |
| Workstation 2 | 10.31.6.5 | 255.255.255.0 | 10.31.6.1 |
| Workstation 3 | 10.31.7.5 | 255.255.255.0 | 10.31.7.1 |
Select the appropriate technology for the egress zone and the label for each layer on the diagram. Each option may be used only once.
Explanation
Egress zone technology: a web application firewall (WAF) sits in the egress zone, in front of the applications that traveling employees and the branch campus reach from the Internet and WAN, and filters HTTP/HTTPS requests for application-layer attacks such as injection and cross-site scripting. The firewalls and anti-DDoS appliances already in the zone handle network-layer filtering and volumetric attacks, so the missing control is application-layer protection. A NIDS only detects and alerts, a NIPS duplicates the packet-level inspection the existing firewalls already provide without understanding web application requests, and DLP addresses sensitive data leaving the organization rather than protecting access to its services. Top layer: the two switches that interconnect the egress zone, the data center and every distribution block form the core layer, which provides fast, redundant transport. Middle layer: each pair of switches that aggregates a block's access switches, and where routing between the 10.31.x.0/24 subnets and policy are applied, is the distribution layer. Bottom layer: the switches and access points that connect workstations and wireless clients are the access layer.
As part of a project to modernize a sports stadium and improve the customer service experience for fans, the stadium owners want to implement a new wireless system. Currently, all tickets are electronic and managed by the stadium mobile application. The new solution is required to allow location tracking precision within 5ft (1.5m) of fans to deliver the following services:
- Emergency/security assistance
- Mobile food order
- Event special effects
- Raffle winner location displayed on the giant stadium screen
Which of the following technologies enables location tracking?
A.SSID
B.BLECorrect
C.NFC
D.IoT
Explanation
Bluetooth Low Energy beacons and direction finding (angle of arrival or departure) let a phone app locate a user indoors to within a meter or two, which meets the 5ft requirement across a large venue. An SSID is just a wireless network name, NFC works only at a few centimeters and cannot track people moving around, and IoT is a broad category rather than a positioning technology.
A company is experiencing Wi-Fi performance issues. Three Wi-Fi networks are available, each running on the 2.4 GHz band and on the same channel. Connecting to each Wi-Fi network yields slow performance. Which of the following channels should the networks be configured to?
A.Channel 1, Channel 2, and Channel 3
B.Channel 2, Channel 4, and Channel 9
C.Channel 1, Channel 6, and Channel 11Correct
D.Channel 3, Channel 5, and Channel 10
Explanation
In the 2.4 GHz band, channels are 5 MHz apart but each one is about 20 MHz wide, so only channels 1, 6 and 11 do not overlap. Putting the three networks on those channels removes co-channel and adjacent-channel interference. The other sets contain channels close enough to overlap and would still interfere.
A company hosts a cloud-based e-commerce application and only wants the application accessed from certain locations. The network team configures a cloud firewall with WAF enabled, but users can access the application globally. Which of the following should the network team do?
A.Reconfigure WAF rules.
B.Configure a NAT gateway.
C.Implement a CDN.
D.Configure geo-restriction.Correct
Explanation
Geo-restriction (geo-blocking) allows or denies requests based on the country or region of the client IP address, which is exactly what limits access to certain locations. Generic WAF rules inspect requests for attacks such as SQL injection and do not by themselves limit geography. A NAT gateway handles outbound address translation, and a CDN improves delivery speed rather than restricting who can connect.
A network architect must ensure only certain departments can access specific resources while on premises. Those same users cannot be allowed to access those resources once they have left campus. Which of the following would ensure access is provided according to these requirements?
A.Enabling MFA for only those users within the departments needing access
B.Configuring geofencing with the IPs of the resourcesCorrect
C.Configuring UEBA to monitor all access to those resources during non-business hours
D.Implementing a PKI-based authentication system to ensure access
Explanation
Geofencing ties access to a location, so access to the resources is allowed only from the campus network and refused once a user is off site. MFA and PKI prove who the user is but work the same from anywhere, and UEBA only monitors and alerts on behavior rather than enforcing a location-based restriction.
A security architect needs to increase the security controls around computer hardware installations. The requirements are:
- Auditable access logs to computer rooms
- Alerts for unauthorized access attempts
- Remote visibility to the inside of computer rooms
Which of the following controls best meet these requirements? (Choose two.)
A.Video surveillanceCorrect
B.NFC access cardsCorrect
C.Motion sensors
D.Locks and keys
E.Security patrols
F.Automated lighting
Explanation
Electronic NFC access cards record every badge use, giving auditable logs, and the access system raises alerts on denied or forced attempts. Video surveillance provides remote visibility into the rooms. Motion sensors alert but give no identity or view, locks and keys leave no log, and patrols and lighting provide neither remote visibility nor audit trails.
A network security engineer must secure a web application running on virtual machines in a public cloud. The virtual machines are behind an application load balancer. Which of the following technologies should the engineer use to secure the virtual machines? (Choose two.)
A.CDN
B.DLP
C.IDS
D.WAFCorrect
E.SIEM
F.NSGCorrect
Explanation
A web application firewall inspects HTTP/HTTPS traffic in front of the application and blocks attacks such as SQL injection and cross-site scripting, and it is typically attached to the application load balancer. A network security group filters traffic at the virtual machine or subnet level so that only the load balancer and required management sources can reach the VMs. A CDN improves content delivery, DLP protects data from leaving the organization, an IDS only detects without blocking, and a SIEM aggregates and correlates logs rather than protecting the VMs directly.
A company is expanding operations and opening a new facility. The executive leadership team decides to purchase an insurance policy that will cover the cost of rebuilding the facility in case of a natural disaster. Which of the following describes the team's decision?
A.Business continuity
B.Disaster recovery
C.Risk transferenceCorrect
D.Memorandum of understanding
Explanation
Buying insurance shifts the financial impact of a risk to a third party, which is risk transference. Business continuity and disaster recovery are plans for keeping operations running and restoring systems after an incident, not decisions about who bears the cost. A memorandum of understanding is a non-binding agreement between parties and has nothing to do with insuring a facility.
A network engineer is establishing a wireless network for handheld inventory scanners in a manufacturing company's warehouse. The engineer needs an authentication mechanism for these scanners that uses the Wi-Fi network and works with the company's Active Directory. The business requires that the solution authenticate the users and authorize the scanners. Which of the following provides the best solution for authentication and authorization?
A.TACACS+
B.RADIUSCorrect
C.LDAP
D.PKI
Explanation
RADIUS is the standard AAA protocol used with 802.1X/WPA2-Enterprise or WPA3-Enterprise Wi-Fi, and a RADIUS server such as Microsoft NPS can authenticate users against Active Directory and return authorization attributes for the scanners. TACACS+ is designed for device administration (logging in to network equipment), not wireless client access. LDAP is a directory query protocol that a RADIUS server may use in the background, but wireless access points do not authenticate clients with it directly. PKI provides certificates but is not an authentication and authorization service by itself.
A company is migrating an application to the cloud for modernization. The engineer needs to provide dependencies between application and database tiers in the environment. Which of the following should the engineer reference in order to best meet this requirement?
A.Internal knowledge base article
B.CMDBCorrect
C.WBS
D.Diagram of physical server locations
E.SOW
Explanation
A configuration management database records configuration items and the relationships between them, so it is the reference for dependencies between the application and database tiers. A knowledge base article describes procedures, a work breakdown structure organizes project tasks, and a statement of work defines contracted deliverables. A diagram of physical server locations shows where hardware sits, not how application components depend on each other.
A network administrator recently deployed new Wi-Fi 6E access points in an office and enabled 6GHz coverage. Users report that when they are connected to the new 6GHz SSID, the performance is worse than the 5GHz SSID. The network administrator suspects that there is a source of 6GHz interference in the office. Using the troubleshooting methodology, which of the following actions should the network administrator do next?
A.Test to see if the changes have improved network performance.
B.Use a spectrum analyzer and check the 6GHz spectrum.Correct
C.Document the list of channels that are experiencing interference.
D.Change the channels being used by the 6GHz radios in the APs.
Explanation
The administrator has already established a theory of probable cause (6 GHz interference), so the next step in the troubleshooting methodology is to test that theory, which is done by scanning the 6 GHz band with a spectrum analyzer. Changing the AP channels would be implementing a fix before the cause is confirmed. Verifying improved performance and documenting findings come after a solution has been implemented.
A SaaS company is launching a new product based in a cloud environment. The new product will be provided as an API and should not be exposed to the internet. Which of the following should the company create to best meet this requirement?
A.A transit gateway that connects the API to the customer's VPC
B.Firewall rules allowing access to the API endpoint from the customer's VPC
C.A VPC peering connection from the API VPC to the customer's VPC
D.A private service endpoint exposing the API endpoint to the customer's VPCCorrect
Explanation
A private service endpoint (such as AWS PrivateLink or an Azure Private Endpoint) exposes only the API service into the customer's VPC over the provider's private network, so the API is never published to the internet and the two networks are not otherwise connected. VPC peering and a transit gateway connect whole networks, which gives broader access than needed and can be complicated by overlapping address ranges. Firewall rules only restrict who can reach an endpoint; they do not by themselves keep it off the internet.
A network administrator is configuring firewall rules to lock down the network from outside attacks. Which of the following should the administrator configure to create the most strict set of rules?
A.URL filtering
B.File blocking
C.Network security group
D.Allow listCorrect
Explanation
An allow list (implicit deny) permits only explicitly approved traffic and blocks everything else, which is the most restrictive rule set. URL filtering and file blocking target specific categories of content and still let other traffic through. A network security group is a cloud filtering construct that can hold either permissive or restrictive rules, so by itself it does not define strictness.
A network engineer is installing new switches in the data center to replace existing infrastructure. The previous network hardware had administrative interfaces that were plugged into the existing network along with all other server hardware on the same subnet. Which of the following should the engineer do to better secure these administrative interfaces?
A.Connect the switch management ports to a separate physical network.Correct
B.Disable unused physical ports on the switches to keep unauthorized users out.
C.Set the administrative interfaces and the network switch ports on the same VLAN.
D.Upgrade all of the switch firmware to the latest hardware levels.
Explanation
Placing switch management ports on a separate, dedicated out-of-band management network isolates the administrative interfaces from the production server subnet, so users and compromised servers cannot reach them. Disabling unused ports is good hardening but does not protect management interfaces that share a subnet with servers. Putting management and data ports on the same VLAN repeats the original problem, and firmware upgrades fix vulnerabilities without separating management traffic.
A network administrator receives a ticket from one of the company's offices about video calls that work normally for one minute and then get very choppy. The network administrator pings the video server from that site to ensure that it is reachable:
```
Ping 10.172.16.16
Pinging 10.172.16.16 with 32 bytes of data:
Reply from 10.172.16.16: bytes=32 time=40ms TTL=53
Reply from 10.172.16.16: bytes=32 time=11ms TTL=53
Reply from 10.172.16.16: bytes=32 time=672ms TTL=53
Reply from 10.172.16.16: bytes=32 time=111ms TTL=53
Reply from 10.172.16.16: bytes=32 time=117ms TTL=53
Reply from 10.172.16.16: bytes=32 time=849ms TTL=53
Reply from 10.172.16.16: bytes=32 time=34ms TTL=53
Reply from 10.172.16.16: bytes=32 time=92ms TTL=53
```
Which of the following is most likely the cause of the video call issue?
A.Throughput
B.JitterCorrect
C.Latency
D.Loss
Explanation
Every ping gets a reply, so there is no packet loss, but the round-trip times swing widely from 11 ms to 849 ms. That variation in delay between packets is jitter, and real-time traffic such as video calls becomes choppy when packets arrive at irregular intervals. Latency alone would show consistently high times rather than large swings, and nothing in the output points to a throughput limit.
A network architect is designing a solution to place network core equipment in a rack inside a data center. This equipment is crucial to the enterprise and must be as secure as possible to minimize the chance that anyone could connect directly to the network core. The current security setup is:
- In a locked building that requires sign in with a guard and identification check.
- In a locked data center accessible by a proximity badge and fingerprint scanner.
- In a locked cabinet that requires the security guard to call the Chief Information Security Officer (CISO) to get permission to provide the key.
Which of the following additional measures should the architect recommend to make this equipment more secure?
A.Make all engineers with access to the data center sign a statement of work.
B.Set up a video surveillance system that has cameras focused on the cabinet.Correct
C.Have the CISO accompany any network engineer that needs to do work in this cabinet.
D.Require anyone entering the data center for any reason to undergo a background check.
Explanation
The existing controls are all preventive layers (building, room and cabinet locks); what is missing is a detective control that records who actually touches the cabinet. Cameras focused on the cabinet deter tampering and provide evidence of anyone connecting to the core. A statement of work is a contract document, not a security control, having the CISO escort every engineer is impractical, and background checks for everyone entering the data center do not monitor the cabinet itself.
An organization has centralized logging capability at the on-premises data center and wants a solution that can consolidate logging from deployed cloud workloads. The organization would like to automate the detection and alerting mechanism. Which of the following best meets the requirements?
A.IDS/IPS
B.SIEMCorrect
C.Data lake
D.Syslog
Explanation
A SIEM collects and correlates logs from on-premises and cloud sources in one place and applies rules to detect events and raise alerts automatically. Syslog only transports and stores log messages, a data lake stores data without built-in detection, and an IDS/IPS inspects network traffic rather than consolidating logs.
Security policy states that all inbound traffic to the environment needs to be restricted, but all external outbound traffic is allowed within the hybrid cloud environment. A new application server was recently set up in the cloud. Which of the following would most likely need to be configured so that the server has the appropriate access set up? (Choose two.)
A.Application gateway
B.IPS
C.Port security
D.FirewallCorrect
E.Network security groupCorrect
F.Screened subnet
Explanation
Restricting inbound traffic while allowing outbound traffic is done with allow and deny rules: a firewall at the environment edge and a network security group attached to the cloud server's subnet or interface. Both filter by source, destination, port and direction. An application gateway is a layer 7 load balancer, an IPS detects and blocks attacks rather than enforcing the access policy, port security limits MAC addresses on switch ports, and a screened subnet is a network zone rather than a rule set.
A company is experiencing multiple switch failures. The network analyst discovers the following:
- Network recovery time is unacceptable and occurs after the shutdown of some switches.
- Some loops were detected in the network.
- No broadcast storm was detected.
Which of the following is the most cost-effective solution?
A.Add a new Layer 3 switch.
B.Add multiple VLANs.
C.Implement STP.Correct
D.Implement tagging.
Explanation
Spanning Tree Protocol (in practice its rapid variant) blocks redundant paths to remove layer 2 loops and automatically reopens a blocked path when a switch or link fails, restoring connectivity without manual action. It is a feature of the existing switches, so it costs nothing extra. A new Layer 3 switch costs money and does not remove loops by itself, and VLANs or tagging segment traffic but do not prevent loops or speed up recovery.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.
