I85PREP
⌘ K
NCCS study materials
NCCS study resources

NCCS practice questions

One question at a time. Build your NCCS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Threat Landscape

In the CIA triad, which property is primarily concerned with ensuring that data has not been altered by an unauthorized party?

  1. Non-repudiation
  2. Confidentiality
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity means data remains accurate and complete and is only changed by authorized processes, so unauthorized modification is an integrity failure. Confidentiality addresses disclosure, availability addresses timely access, and non-repudiation addresses proof that an action occurred.

Question 2Security Fundamentals and Threat Landscape

A user receives an email that appears to come from the finance director and urgently requests a wire transfer before a supposed audit deadline. Which attack type does this best describe?

  1. Watering hole
  2. SQL injection
  3. Distributed denial of service
  4. Business email compromise Correct answer.

Explanation

Business email compromise relies on impersonating or hijacking a trusted executive account to pressure an employee into transferring funds or data. The urgency and authority cues are characteristic social engineering signals.

Question 3Security Fundamentals and Threat Landscape

Which malware characteristic distinguishes a worm from a virus?

  1. A worm self-propagates across networks without needing a host file or user action Correct answer.
  2. A worm always encrypts files and demands payment
  3. A worm resides solely in the master boot record
  4. A worm only executes when a user opens an infected attachment

Explanation

Worms spread autonomously by exploiting network services, so they do not require a user to launch an infected file. Viruses depend on a host file and typically on user execution to propagate.

Question 4Security Fundamentals and Threat Landscape

An organization wants to reduce the risk of an attacker reusing stolen password hashes. Which control most directly addresses this?

  1. Increasing the password maximum length to 64 characters
  2. Publishing a password complexity policy only
  3. Reducing the account lockout threshold to two attempts
  4. Enforcing multi-factor authentication for all accounts Correct answer.

Explanation

Multi-factor authentication requires a second factor beyond the password, so a stolen hash alone cannot grant access. Complexity policies and lockout thresholds affect guessing resistance but not the value of a leaked credential.

Question 5Security Fundamentals and Threat Landscape

Which statement best describes the principle of least privilege?

  1. All administrators share one privileged account to simplify auditing
  2. Every user is given read access to all company file shares
  3. Users and processes receive only the access required to perform their assigned tasks Correct answer.
  4. Access rights are granted permanently once a user is onboarded

Explanation

Least privilege limits permissions to the minimum necessary for a role or task, reducing the blast radius of compromise or error. Permanent broad access and shared accounts conflict with that principle and weaken accountability.

Question 6Security Fundamentals and Threat Landscape

In risk management, what does the term residual risk refer to?

  1. The cost of implementing a security control
  2. The risk that remains after existing controls have been applied Correct answer.
  3. The total risk before any controls are considered
  4. The likelihood that a threat actor will target the organization

Explanation

Residual risk is what is left over after safeguards reduce inherent risk, and management must decide whether to accept it. Inherent risk is the pre-control exposure, and control cost is a separate input to the treatment decision.

Question 7Security Fundamentals and Threat Landscape

Which security control is an example of a physical control?

  1. A firewall filtering inbound traffic
  2. An antivirus signature update schedule
  3. A security awareness training module
  4. A badge reader restricting entry to a data center Correct answer.

Explanation

Physical controls manage access to facilities and hardware, and a badge reader restricting data center entry is a clear example. Firewalls and antivirus are technical controls, while training is an administrative control.

Question 8Security Fundamentals and Threat Landscape

What is the primary purpose of network segmentation in a security architecture?

  1. To eliminate the need for authentication on internal systems
  2. To increase the available bandwidth between all hosts
  3. To limit lateral movement by containing systems within smaller trust zones Correct answer.
  4. To replace endpoint detection with perimeter firewalls

Explanation

Segmentation divides a network into zones with controlled traffic between them, so a compromised host cannot freely reach unrelated systems. It supports containment and defense in depth rather than replacing authentication or endpoint monitoring.

Question 9Security Fundamentals and Threat Landscape

A security team wants to detect unauthorized changes to critical configuration files on servers. Which control best fits this goal?

  1. Full-disk encryption
  2. File integrity monitoring Correct answer.
  3. Data loss prevention
  4. Security awareness training

Explanation

File integrity monitoring baselines critical files and alerts when their contents or attributes change unexpectedly. DLP targets data exfiltration, encryption protects data at rest, and training shapes user behavior.

Question 10Security Fundamentals and Threat Landscape

An attacker sends a crafted input that causes an application to return database error messages containing table names. Which weakness is most directly demonstrated?

  1. Weak password hashing algorithm
  2. Insufficient logging of administrator actions
  3. Improper error handling that discloses internal information Correct answer.
  4. Missing network segmentation

Explanation

Verbose error messages reveal schema details that help an attacker refine injection attempts, which is an information disclosure weakness in error handling. The other options concern accountability, credential storage, or network design rather than response content.

Question 11Security Fundamentals and Threat Landscape

Which activity is part of the identification phase of an incident response lifecycle?

  1. Eradicating malware from affected hosts
  2. Conducting a post-incident lessons-learned review
  3. Restoring systems from clean backups
  4. Confirming that an alert represents a genuine security event Correct answer.

Explanation

Identification, often paired with detection, determines whether an observed event is a real incident and scopes it. Eradication removes the cause, recovery restores services, and lessons learned follows containment and recovery.

Question 12Security Fundamentals and Threat Landscape

An employee plugs an unknown USB drive found in the parking lot into a workstation. Which threat vector does this illustrate?

  1. Supply chain compromise of a software vendor
  2. Man-in-the-middle interception of wireless traffic
  3. Credential stuffing against a public login
  4. Removable media as an attack vector Correct answer.

Explanation

Dropped or unauthorized removable media can deliver malware or malicious scripts when connected, making it a physical and endpoint vector. The other options describe different delivery paths that do not involve a found device.

Question 13Security Fundamentals and Threat Landscape

A web application stores session identifiers in URLs. Which security concern is most significant?

  1. Session tokens become computationally infeasible to generate
  2. Session cookies cannot be encrypted at rest
  3. Session identifiers expire too quickly for users
  4. Session tokens may leak through logs, browser history, and referrer headers Correct answer.

Explanation

Tokens embedded in URLs are recorded in proxy logs, browser history, and referrer headers, allowing an attacker who obtains them to hijack sessions. Keeping identifiers in secure cookies avoids these exposure paths.

Question 14Security Fundamentals and Threat Landscape

Which practice most effectively mitigates the risk of successful phishing emails leading to credential theft?

  1. Disabling email attachment scanning to improve delivery speed
  2. Allowing users to reuse passwords across services
  3. Phishing-resistant multi-factor authentication such as FIDO2 security keys Correct answer.
  4. Annual password complexity reminders

Explanation

Phishing-resistant authenticators bind the credential to the legitimate origin, so a captured password and code cannot be replayed on a fake site. Reminders and password reuse do not stop real-time credential relay.

Question 15Security Fundamentals and Threat Landscape

What is the main security benefit of application allowlisting on endpoints?

  1. User passwords are rotated automatically
  2. All inbound network traffic is inspected for signatures
  3. Only approved executables can run, blocking many unapproved malware payloads Correct answer.
  4. Backups are encrypted with a customer-managed key

Explanation

Allowlisting defines which binaries may execute, so unknown malware that lacks an approved signature cannot launch. It complements but does not replace network inspection, credential policy, or backup encryption.

Question 16Security Fundamentals and Threat Landscape

An organization discovers that a vendor's software update was tampered with before distribution. Which threat category applies?

  1. Physical theft
  2. Denial of service
  3. Supply chain attack Correct answer.
  4. Insider data exfiltration

Explanation

A supply chain attack compromises a trusted third party, product, or distribution channel so that malicious content reaches customers. Tampering with an update before distribution fits that category precisely.

Question 17Security Fundamentals and Threat Landscape

Which element of a defense-in-depth strategy reduces the impact of a compromised internal host?

  1. Disabling host-based logging to save disk space
  2. A single perimeter firewall with permissive internal routing
  3. Microsegmentation with deny-by-default east-west rules Correct answer.
  4. Shared local administrator credentials across servers

Explanation

Deny-by-default internal rules restrict what a compromised host can reach, containing the incident and limiting lateral movement. Flat internal routing, shared credentials, and missing logs all increase impact.

Question 18Security Fundamentals and Threat Landscape

What does a hash function provide when used to verify file integrity?

  1. A fixed-length value that changes if the file content changes Correct answer.
  2. Reversible encryption of the file contents
  3. Compression of the file for efficient storage
  4. Proof of the file author's identity

Explanation

A cryptographic hash maps content to a fixed-length digest, and any change to the input produces a different digest with high probability. It is one-way and does not establish authorship or encrypt the file.

Question 19Security Fundamentals and Threat Landscape

A security analyst notices repeated authentication failures from one account followed by a successful login from a foreign address minutes later. Which conclusion is most appropriate?

  1. The firewall is misconfigured and should be disabled
  2. The events are normal and require no action
  3. The user probably forgot the password and changed it
  4. The account may be compromised and should be investigated and contained Correct answer.

Explanation

A burst of failures followed by success from an unusual location suggests password guessing or credential stuffing that succeeded. Containment such as session revocation and password reset is warranted while the event is investigated.

Question 20Security Fundamentals and Threat Landscape

Which security model enforces access decisions based on the sensitivity labels of objects and the clearance of subjects?

  1. Role-based access control
  2. Mandatory access control Correct answer.
  3. Discretionary access control
  4. Attribute-based access control

Explanation

Mandatory access control compares subject clearance with object classification labels, and owners cannot override the policy. Discretionary control lets owners set permissions, while role and attribute models use roles or contextual attributes.

Question 21Security Fundamentals and Threat Landscape

A company wants to reduce the risk of a successful ransomware attack encrypting backups. Which measure addresses this most directly?

  1. Increasing backup frequency to every hour
  2. Maintaining immutable or offline backup copies isolated from production credentials Correct answer.
  3. Compressing backups to reduce storage costs
  4. Storing backup credentials in a script on a production server

Explanation

Immutable or offline copies cannot be altered or deleted by ransomware operating with production credentials, preserving recovery options. Frequency and compression help operations but do not prevent tampering.

Question 22Security Fundamentals and Threat Landscape

An attacker intercepts traffic between a user and a server and relays messages while impersonating each side. Which term best describes this attack?

  1. Directory traversal
  2. Privilege escalation
  3. Cross-site scripting
  4. On-path attack Correct answer.

Explanation

An on-path, or man-in-the-middle, attack places the adversary between two parties to read or modify traffic. Cross-site scripting targets browsers, privilege escalation gains higher rights, and directory traversal reads files outside an intended path.

Question 23Security Fundamentals and Threat Landscape

A developer finds that a web application trusts a hidden form field to set a user's account balance. Which vulnerability class is present?

  1. Insecure direct object reference combined with client-side trust Correct answer.
  2. DNS cache poisoning
  3. Cross-site request forgery
  4. Buffer overflow

Explanation

The server accepts a client-controlled value to determine which object or amount is used, so tampering with the hidden field alters protected data. Authorization must be enforced server-side against the authenticated identity.

Question 24Security Fundamentals and Threat Landscape

Why is a digital signature insufficient on its own to prove that the signer intended to approve a document's full contents?

  1. It expires before the document is delivered
  2. It proves integrity and key possession but not the signer's understanding or intent Correct answer.
  3. It uses symmetric keys that both parties share
  4. It encrypts the document so the signer cannot read it

Explanation

A signature demonstrates that the private key holder signed the exact bytes and that they were unchanged, but intent and comprehension are outside cryptographic guarantees. Non-repudiation is strengthened by process controls such as review workflows and audit trails.

Question 25Security Fundamentals and Threat Landscape

A threat model identifies that an internal API accepts requests from any host in the corporate network. Which change best reduces the attack surface without breaking legitimate callers?

  1. Disable logging on the API to reduce noise
  2. Rely on the perimeter firewall alone for protection
  3. Move the API to a different TCP port
  4. Require mutual authentication and authorize each caller against an explicit service policy Correct answer.

Explanation

Requiring strong caller identity and explicit authorization ensures only intended services can invoke the API, shrinking the set of viable attackers. Port changes and perimeter-only defenses do not establish caller trust.

Question 26Security Fundamentals and Threat Landscape

Which statement best distinguishes a vulnerability from a threat in security risk analysis?

  1. A vulnerability is an attacker with intent and capability, while a threat is a missing patch on a server.
  2. A vulnerability is a logged security event, while a threat is the alert generated when that event repeats.
  3. A vulnerability is a weakness that can be exploited, while a threat is a potential actor or event that could exploit it. Correct answer.
  4. A vulnerability is the measured business loss after an incident, while a threat is the insurance covering that loss.

Explanation

In risk terminology a vulnerability is an internal weakness in a system, process, or control, such as an unpatched service or a weak configuration. A threat is an external or potential source of harm, such as a criminal group, malware campaign, or natural event, that could act on that weakness. Risk arises from the combination of threat, vulnerability, and impact, so the two terms describe different sides of the same exposure.

Question 27Security Fundamentals and Threat Landscape

An organization wants a control that limits the damage an insider can cause by copying sensitive files to personal cloud storage. Which control type addresses this goal most directly?

  1. Weekly vulnerability scans of the internal server subnet
  2. A longer minimum password length for all domain accounts
  3. Data loss prevention policies that block uploads of classified content to unapproved destinations Correct answer.
  4. Full-disk encryption enabled on every employee laptop

Explanation

Data loss prevention inspects outbound content and blocks or logs transfers of classified data to unauthorized destinations such as personal cloud storage, which directly targets exfiltration by an insider. Encryption protects data at rest if a device is lost but does not stop an authorized user from uploading files. Password length and vulnerability scanning address credential strength and software flaws rather than data movement.

Question 28Security Fundamentals and Threat Landscape

A hospital must enforce that only clinicians with a treatment relationship to a patient can view that patient's record, even if other staff hold the same job title. Which access control approach fits this requirement best?

  1. Attribute-based access control that evaluates user, resource, and context attributes together Correct answer.
  2. Role-based access control keyed to the clinician job title
  3. Mandatory access control based on classification labels and clearances
  4. Discretionary access control where record owners set permissions

Explanation

Attribute-based access control evaluates policies combining subject attributes, resource attributes, and environmental context, so access can depend on whether a specific clinician has a treatment relationship with a specific patient. Role-based control alone grants access by job title and cannot distinguish one clinician's patients from another's. Mandatory access control uses labels and clearances and does not express treatment relationships, while discretionary control leaves decisions to owners and is inconsistent for regulated records.

Question 29Security Fundamentals and Threat Landscape

During an assessment, a tester discovers that a web server responds to malformed requests with a banner revealing the exact framework version and patch level. Which risk does this finding primarily increase?

  1. Loss of audit logs recording administrative actions
  2. Interception of credentials in transit between client and server
  3. Exploitation of known vulnerabilities specific to that framework version Correct answer.
  4. Corruption of the database through malformed queries

Explanation

Version banners let an attacker map the target to publicly documented vulnerabilities and exploits for that exact release, shortening reconnaissance and raising the chance of successful exploitation. The banner itself does not decrypt traffic, disable logging, or alter stored data. The correct remediation is to suppress detailed version information and keep the framework patched, treating the disclosure as a supporting weakness rather than the exploit itself.

Question 30Security Fundamentals and Threat Landscape

A retailer's point-of-sale terminals run an operating system that no longer receives vendor security patches, but the terminals cannot be replaced for another year. Which combination of compensating measures best reduces risk during that period?

  1. Increasing the frequency of full antivirus scans on the terminals and lengthening user passwords
  2. Encrypting the terminal disks and requiring managers to approve each transaction manually
  3. Adding the terminals to the vulnerability scan scope and reporting findings to the vendor each quarter
  4. Isolating the terminals on a restricted network segment with strict allowlisted connections and monitoring for anomalous traffic Correct answer.

Explanation

When patching is impossible, the strongest compensations reduce exposure and detect abuse: segment the unsupported systems, permit only the specific connections they need, and monitor that traffic for deviations. This limits lateral movement and shortens detection time. Scanning more often, encrypting disks, or lengthening passwords does not remove the unpatched vulnerabilities or constrain how an attacker could reach and abuse the terminals.

Question 31Network Security and Perimeter Defense

Which security control is best described as placing a device inline to inspect and filter traffic between two network segments of differing trust levels?

  1. A load balancer
  2. A DHCP relay
  3. A firewall Correct answer.
  4. A syslog server

Explanation

A firewall is deployed inline so that all traffic passing between segments is examined against a rule set before being allowed through. Devices that only collect logs or distribute sessions do not enforce filtering policy at the boundary.

Question 32Network Security and Perimeter Defense

What is the primary security purpose of network segmentation in a corporate environment?

  1. To limit lateral movement between zones of differing sensitivity Correct answer.
  2. To simplify routing by collapsing all subnets into one
  3. To eliminate the need for authentication inside the LAN
  4. To increase available bandwidth on the core

Explanation

Segmentation divides the network into zones so that a compromise in one area cannot freely reach more sensitive systems. It reduces the blast radius of an intrusion rather than improving raw throughput or removing authentication.

Question 33Network Security and Perimeter Defense

A demilitarized zone (DMZ) is typically used to host which type of system?

  1. Internal HR workstations
  2. Backup tapes stored offline
  3. Domain controllers holding privileged credentials
  4. Public-facing web and mail servers Correct answer.

Explanation

A DMZ is a buffer zone between the internet and the internal network, intended for services that must be reachable externally. Placing them there keeps direct inbound paths away from the trusted internal LAN.

Question 34Network Security and Perimeter Defense

Which protocol and port combination is used by a stateful firewall to track established TCP sessions?

  1. It reads the application payload of every packet
  2. It queries a DNS server for each flow
  3. It inspects the TCP flags and sequence state of each connection Correct answer.
  4. It relies solely on source IP address matching

Explanation

A stateful firewall maintains a session table keyed on the five-tuple and tracks TCP handshake and flag state to decide whether a packet belongs to an allowed connection. Stateless filtering looks only at individual packet headers.

Question 35Network Security and Perimeter Defense

What does a virtual private network (VPN) primarily provide for remote users connecting to a corporate network?

  1. Guaranteed bandwidth for all applications
  2. Replacement of the need for multifactor authentication
  3. An encrypted tunnel over an untrusted network Correct answer.
  4. Automatic patching of the client endpoint

Explanation

A VPN establishes an encrypted tunnel so that traffic crossing an untrusted medium such as the internet cannot be read or altered in transit. It protects confidentiality and integrity of the channel, not endpoint hygiene or bandwidth.

Question 36Network Security and Perimeter Defense

An IDS sensor is deployed in promiscuous mode on a mirrored switch port. What is its primary function?

  1. To block malicious traffic inline
  2. To detect and alert on suspicious traffic without blocking it Correct answer.
  3. To encrypt traffic between internal hosts
  4. To assign IP addresses to endpoints

Explanation

An intrusion detection system monitors a copy of traffic and generates alerts, but it does not sit inline to drop packets. Blocking behavior is characteristic of an intrusion prevention system.

Question 37Network Security and Perimeter Defense

Which addressing scheme is most appropriate for a perimeter firewall's public-facing interface?

  1. A link-local 169.254 address
  2. A private RFC 1918 address only
  3. A publicly routable address or a NAT translation to one Correct answer.
  4. An unconfigured interface

Explanation

The external interface must be reachable from the internet, either by a public address or through a NAT mapping to a public address. RFC 1918 and link-local addresses are not routable across the public internet.

Question 38Network Security and Perimeter Defense

What is the purpose of a network access control (NAC) solution at the perimeter?

  1. To assess endpoint compliance before granting network access Correct answer.
  2. To provide content caching for web browsing
  3. To resolve hostnames for internal users
  4. To compress traffic on WAN links

Explanation

NAC checks device posture, such as patch level or antivirus status, and decides whether to admit, quarantine, or deny the endpoint. It enforces admission policy rather than optimizing traffic or resolving names.

Question 39Network Security and Perimeter Defense

A security engineer wants a firewall rule that permits only HTTPS from the internet to a single web server. Which rule design is most precise?

  1. Deny all traffic to the web server
  2. Permit any source to any destination on any port
  3. Permit the internet to the internal LAN on TCP 443
  4. Permit any source to the web server IP on TCP 443 Correct answer.

Explanation

Least-privilege rule design specifies the source zone, destination host, and exact service required. Restricting to the web server IP on TCP 443 limits exposure to the minimum needed for HTTPS.

Question 40Network Security and Perimeter Defense

An organization uses a screened subnet architecture with an external firewall, a DMZ, and an internal firewall. What is the main benefit of the second firewall?

  1. It provides faster routing between subnets
  2. It replaces host-based firewalls on servers
  3. It eliminates the need for the external firewall
  4. It adds a second policy enforcement point between the DMZ and the internal network Correct answer.

Explanation

A dual-firewall design means that even if a DMZ host is compromised, the attacker still faces a separate policy boundary before reaching internal systems. Defense in depth reduces the chance of a single control failure exposing the core.

Question 41Network Security and Perimeter Defense

Which technique allows several internal hosts to share one public IPv4 address for outbound internet access?

  1. Spanning Tree Protocol
  2. Port address translation (PAT) Correct answer.
  3. VLAN trunking
  4. Static routing

Explanation

PAT, also called NAT overload, maps many internal sessions to a single public address by translating source ports so replies can be demultiplexed. Static routing, trunking, and STP do not perform address translation.

Question 42Network Security and Perimeter Defense

A packet capture shows repeated SYN packets from many spoofed source addresses to a single web server. Which perimeter control most directly mitigates this condition?

  1. Increasing the server's disk capacity
  2. Enabling DHCP snooping on the internal LAN
  3. SYN cookies and rate limiting on the perimeter device Correct answer.
  4. Deploying a reverse proxy for static content caching

Explanation

The pattern describes a SYN flood, and SYN cookies plus rate limiting absorb half-open connection attempts without exhausting server resources. Disk capacity, DHCP snooping, and caching do not address connection-flood exhaustion.

Question 43Network Security and Perimeter Defense

What is the primary role of an application-layer gateway (proxy firewall) compared with a packet-filtering firewall?

  1. It encrypts all traffic between VLANs
  2. It inspects and understands protocol-level content to enforce application policy Correct answer.
  3. It provides physical port security
  4. It forwards packets based only on IP and port

Explanation

A proxy firewall terminates and re-originates connections at the application layer, allowing it to inspect protocol commands and content. Packet filters only see header fields such as addresses and ports.

Question 44Network Security and Perimeter Defense

An administrator configures 802.1X on switch ports for wired access. Which component issues the authentication decision to the switch?

  1. The DHCP server
  2. The supplicant on the endpoint
  3. The RADIUS authentication server Correct answer.
  4. The authenticator switch itself

Explanation

In 802.1X the supplicant requests access, the switch acts as authenticator and relays credentials, and the RADIUS server makes the authentication decision. The switch enforces that decision but does not originate it.

Question 45Network Security and Perimeter Defense

Which control best protects against ARP spoofing on a switched internal network?

  1. Enabling port mirroring on all access ports
  2. Dynamic ARP Inspection with DHCP snooping Correct answer.
  3. Using a hub instead of a switch
  4. Disabling Spanning Tree Protocol

Explanation

Dynamic ARP Inspection validates ARP packets against a trusted binding table built from DHCP snooping, blocking forged replies. Port mirroring and STP changes do not validate ARP bindings.

Question 46Network Security and Perimeter Defense

What does a web application firewall (WAF) most directly protect against?

  1. Injection and cross-site scripting attacks against an HTTP service Correct answer.
  2. Rogue DHCP servers on the LAN
  3. Weak wireless encryption on guest Wi-Fi
  4. Unauthorized physical access to a data center

Explanation

A WAF inspects HTTP requests and responses to detect and block application-layer attacks such as SQL injection and cross-site scripting. It does not address Layer 2, physical, or wireless controls.

Question 47Network Security and Perimeter Defense

A security analyst observes an outbound connection from an internal host to a known command-and-control IP over TCP 443. Which perimeter response most directly contains the threat?

  1. Block the destination IP at the egress firewall and isolate the host Correct answer.
  2. Enable NTP synchronization on the host
  3. Increase the firewall log retention period
  4. Add the host to the internal DNS forwarder

Explanation

Egress filtering to the known malicious destination cuts the control channel, and isolating the host prevents further internal spread while investigation proceeds. Log retention and time sync support investigation but do not contain the active threat.

Question 48Network Security and Perimeter Defense

Which statement correctly distinguishes a stateful firewall from a stateless packet filter?

  1. The stateful firewall cannot inspect TCP flags
  2. The stateful firewall tracks connection state and can permit return traffic automatically Correct answer.
  3. The stateless filter performs deep packet inspection of payloads
  4. The stateless filter tracks connection state and permits return traffic automatically

Explanation

A stateful firewall records allowed sessions in a state table and lets replies traverse without an explicit inbound rule. A stateless filter evaluates each packet independently and requires rules in both directions.

Question 49Network Security and Perimeter Defense

An organization wants to allow remote workers to reach only a specific internal application, not the whole corporate LAN. Which design best meets this requirement?

  1. A split-tunnel VPN with full LAN routes
  2. A site-to-site VPN to the data center with no filtering
  3. A public IP address directly on the application server
  4. A VPN with role-based access control that scopes routes and firewall policy to the application Correct answer.

Explanation

Least privilege for remote access means granting only the routes and application permissions each user role requires. Combining VPN with role-based policy limits exposure compared with broad LAN access.

Question 50Network Security and Perimeter Defense

A perimeter device is configured with an implicit deny at the end of its rule set. What is the effect of this configuration?

  1. Only inbound traffic is dropped
  2. The rule set is ignored for established sessions
  3. All traffic is permitted unless a deny rule matches
  4. Traffic not explicitly permitted by a rule is dropped Correct answer.

Explanation

An implicit deny is a default-drop posture applied after all explicit rules are evaluated. Anything not matched by a permit rule is denied, which enforces a default-closed perimeter.