CISA Network and Infrastructure Security 1 — Questions and Answers
Question 1: Which network security device inspects packet headers and filters traffic based on predefined rules without examining packet content?
- Stateful firewall
- Packet-filtering firewall (Correct answer)
- Intrusion Detection System
- Web application firewall
Correct answer: Packet-filtering firewall
A packet-filtering firewall examines IP headers, ports, and protocols but does not inspect the actual content of packets.
Question 2: A CISA auditor reviewing network segmentation should PRIMARILY verify that:
- All systems reside on a single flat network
- Critical systems are isolated in separate network zones (Correct answer)
- Wireless and wired networks share the same subnet
- Firewalls are only deployed at the network perimeter
Correct answer: Critical systems are isolated in separate network zones
Proper network segmentation places critical systems in isolated zones to limit the blast radius of a breach.
Question 3: Which protocol provides encrypted remote administration of network devices and is preferred over Telnet?
- SNMP v2
- SSH (Correct answer)
- FTP
- HTTP
Correct answer: SSH
SSH (Secure Shell) encrypts the entire session, whereas Telnet transmits credentials and data in plaintext.
Question 4: An Intrusion Prevention System (IPS) differs from an IDS primarily because an IPS can:
- Generate alerts for suspicious activity
- Log network traffic for forensic analysis
- Actively block or drop malicious traffic in real time (Correct answer)
- Perform vulnerability scans on endpoints
Correct answer: Actively block or drop malicious traffic in real time
An IPS sits inline with traffic and can actively block threats, whereas an IDS only monitors and alerts.
Question 5: During a network audit, an IS auditor finds that SNMP v1 is still in use. The PRIMARY concern is:
- SNMP v1 uses too much bandwidth
- SNMP v1 community strings are transmitted in plaintext (Correct answer)
- SNMP v1 does not support IPv6
- SNMP v1 cannot monitor router interfaces
Correct answer: SNMP v1 community strings are transmitted in plaintext
SNMP v1 community strings (essentially passwords) are sent in cleartext, making them vulnerable to interception.
Question 6: A DMZ (Demilitarized Zone) is BEST described as:
- A segment where only internal users can access resources
- A network zone between the internet and the internal network that hosts public-facing services (Correct answer)
- A backup network used only during disaster recovery
- A VLAN reserved for administrative management traffic
Correct answer: A network zone between the internet and the internal network that hosts public-facing services
A DMZ provides a buffer zone that exposes public services (e.g., web servers) while shielding the internal network.
CISA Network and Infrastructure Security 1
Which network security device inspects packet headers and filters traffic based on predefined rules without examining packet content?