IKM - International Knowledge Measurement Network Engineering and Security Questions and Answers 1 — Questions and Answers
Question 1: A network security engineer is hardening a perimeter firewall. The policy requires that only explicitly allowed traffic can enter the network. After adding rules to permit necessary services like HTTPS (port 443), which of the following rules is MOST critical to place at the very end of the inbound Access Control List (ACL)?
- permit ip any any
- deny ip any any (Correct answer)
- permit tcp any established
- deny udp any any
Correct answer: deny ip any any
The principle of 'deny by default' or 'least privilege' is a cornerstone of network security. After explicitly permitting required traffic, a 'deny ip any any' rule at the end of the ACL ensures that any traffic not specifically allowed is blocked. This prevents unintended access and serves as a critical safeguard.
Question 2: In the OSPF routing protocol, what is the primary purpose of electing a Designated Router (DR) on a multi-access network segment like Ethernet?
- To assign IP addresses to other routers on the segment.
- To encrypt all routing information shared on the segment.
- To reduce the number of adjacencies and routing updates exchanged. (Correct answer)
- To act as the sole default gateway for all hosts on the network.
Correct answer: To reduce the number of adjacencies and routing updates exchanged.
On multi-access networks (like Ethernet), many routers can be connected. Without a DR, every router would need to form a full adjacency with every other router, leading to a high volume of redundant Link State Advertisements (LSAs). The DR acts as a central point for updates; all other routers form an adjacency with the DR, which then distributes the updates, significantly reducing protocol traffic and processing overhead.
Question 3: A company wants to provide remote employees with access to a specific internal web-based application. The goal is to offer a solution that does not require installing a dedicated VPN client and can be easily accessed through a standard web browser. Which of the following VPN technologies is best suited for this requirement?
- IPsec VPN
- L2TP/IPsec
- GRE Tunnel
- SSL/TLS VPN (Correct answer)
Correct answer: SSL/TLS VPN
SSL/TLS VPNs are designed to provide secure remote access to specific applications, particularly web-based ones, directly through a web browser. This 'clientless' approach is ideal for scenarios where installing dedicated software on each remote device is undesirable or impractical. IPsec VPNs, in contrast, operate at the network layer and typically require a dedicated software client to provide full network access.
Question 4: A junior network administrator connects two switches using two separate Ethernet cables, intending to provide redundancy. Shortly after, users report that the network is extremely slow and unusable. The activity lights on the switches are blinking constantly and rapidly. What is the MOST likely cause of this issue?
- A broadcast storm caused by a Layer 2 loop. (Correct answer)
- A misconfigured Network Address Translation (NAT) pool.
- The switches have insufficient RAM to handle the traffic.
- The Ethernet cables have exceeded their maximum supported length.
Correct answer: A broadcast storm caused by a Layer 2 loop.
Connecting two switches with multiple links without a loop prevention mechanism like Spanning Tree Protocol (STP) creates a Layer 2 loop. Broadcast frames sent by a host will be forwarded by the switches in an endless circle, amplifying with each pass. This creates a broadcast storm that consumes all available bandwidth and switch CPU resources, bringing the network to a halt.
Question 5: Which statement accurately describes the fundamental difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS)?
- An IDS is a hardware appliance, while an IPS is a software solution.
- An IDS can only use signature-based detection, while an IPS uses anomaly-based detection.
- An IDS is deployed out-of-band to monitor and alert, while an IPS is deployed inline to actively block threats. (Correct answer)
- An IDS is used for internal networks, while an IPS is used for perimeter security.
Correct answer: An IDS is deployed out-of-band to monitor and alert, while an IPS is deployed inline to actively block threats.
The core distinction lies in their operational mode and response capability. An IDS is a passive system that monitors network traffic (often via a network tap or SPAN port) and sends alerts when it detects suspicious activity. An IPS is an active, inline device that inspects traffic as it passes through and can take immediate action to block or drop malicious packets, thereby preventing an attack.
Question 6: A company needs to logically separate the network traffic of its Human Resources and Engineering departments, despite all employees being connected to the same physical switches. The primary goals are to enhance security by preventing devices in one department from easily accessing devices in the other and to reduce broadcast traffic. Which technology is MOST suitable for this purpose?
- Physical air-gapping of networks
- Subnetting with static IP addresses
- Virtual Local Area Networks (VLANs) (Correct answer)
- Quality of Service (QoS) tagging
Correct answer: Virtual Local Area Networks (VLANs)
Virtual Local Area Networks (VLANs) are the standard technology for logically segmenting a single physical network into multiple, isolated broadcast domains. By assigning switch ports to different VLANs (e.g., one for HR, one for Engineering), traffic is contained within that VLAN. This enhances security and improves performance by limiting the scope of broadcast traffic.
IKM - International Knowledge Measurement Network Engineering and Security Questions and Answers 1
A network security engineer is hardening a perimeter firewall.
The policy requires that only explicitly allowed traffic can enter the network.
After adding rules to permit necessary services like HTTPS (port 443), which of the following rules is MOST critical to place at the very end of the inbound Access Control List (ACL)?