Network Security

A network administrator configures a stateless extended IPv4 Access Control List (ACL) on a router interface to allow workstations on the internal subnet $172.20.5.0/24$ to issue domain name queries to an external DNS server at $8.8.8.8$. The administrator applies the following rule inbound on the LAN-facing interface:

`permit udp 172.20.5.0 0.0.0.255 host 8.8.8.8 eq 53`

Host $172.20.5.50$ sends DNS queries to $8.8.8.8$, but all lookups time out. Packet captures show that outgoing requests reach the DNS server, but the responses never arrive back at the workstation. Which of the following best explains why the return traffic is failing?

Match each network security authentication protocol or access control framework to its corresponding architectural characteristic and transport specification.

A network administrator needs to deploy a security solution that can analyze network traffic in real time and automatically drop malicious packets before they reach the internal network. Which system type and deployment mode best meets this requirement?

During a security audit of network infrastructure management practices, an auditor notes that switch management sessions rely on a protocol that encrypts only the password field within packet headers and combines authentication and authorization into a single service over UDP. To achieve full payload encryption, command-by-command authorization decoupling, and reliable connection-oriented transport on port 49, which protocol should be deployed?

A network administrator configures an extended IPv4 Access Control List (ACL) on a router interface filtering inbound traffic toward an internal database subnet ($10.50.10.0/24$). The ACL is designed to meet three requirements:
1. Allow secure administration from a jump host at $10.50.1.15$ via SSH (TCP 22).
2. Allow application servers on subnet $10.50.2.0/24$ to access the database server at $10.50.10.100$ on TCP port 5432.
3. Block all other traffic originating from subnet $10.50.2.0/24$.

The administrator enters the following ACL entries in sequential order:
- Entry 10: `permit tcp host 10.50.1.15 10.50.10.0 0.0.0.255 eq 22`
- Entry 20: `deny ip 10.50.2.0 0.0.0.255 10.50.10.0 0.0.0.255`
- Entry 30: `permit tcp 10.50.2.0 0.0.0.255 host 10.50.10.100 eq 5432`

During testing, application servers on subnet $10.50.2.0/24$ are unable to establish database connections to $10.50.10.100:5432$. Which of the following best explains why this configuration fails?

A network technician discovers that queries sent to the local DNS server for a company intranet portal are resolving to an unauthorized external IP address due to corrupted cache entries. Which network attack vector does this scenario describe?

A security technician needs to configure an extended Access Control List (ACL) rule on a router to permit secure HTTPS web traffic from an internal subnet to an external web server. Which transport protocol and destination port combination must be specified in the ACL rule to correctly match this traffic?

A network administrator is auditing the physical and environmental security controls of a newly built enterprise data center. During inspection, the administrator notes that the HVAC system is maintaining ambient relative humidity at 15% inside the server room. Which of the following recommendations should the administrator make to address the primary risk caused by this environmental condition?

A network engineer at a high-density regional hospital is upgrading the facility's wireless infrastructure to improve security and auditability. The security policy mandates that every medical staff member must authenticate to the corporate SSID using their unique Active Directory credentials, allowing central logging of user sessions via 802.1X RADIUS. During the deployment planning, a technician proposes configuring WPA3-Personal with Simultaneous Authentication of Equals (SAE) and distributing unique static passphrases to staff groups to avoid modifying existing RADIUS server certificate policies. Which of the following best explains why the technician's proposed solution fails to meet the corporate security mandate, and what configuration must be enforced instead?

A network administrator is configuring an extended IPv4 Access Control List (ACL) on a router interface to control traffic from the client workstation subnet ($172.16.10.0/24$) targeting the corporate server farm subnet ($10.5.0.0/24$). The security policy specifies the following requirements for traffic destined for the database server ($10.5.0.20$) and the rest of the server farm:

1. SSH administrative access (TCP port 22) to host $10.5.0.20$ must be permitted ONLY from the primary administrator workstation at IP address $172.16.10.5$.
2. All other SSH traffic (TCP port 22) to host $10.5.0.20$ originating from subnet $172.16.10.0/24$ must be explicitly blocked.
3. All non-SSH TCP traffic from subnet $172.16.10.0/24$ to host $10.5.0.20$ must be permitted.
4. Non-TCP IP traffic from subnet $172.16.10.0/24$ to host $10.5.0.20$ must be blocked.
5. All IP traffic from subnet $172.16.10.0/24$ to all other servers in subnet $10.5.0.0/24$ must be permitted.

In what top-to-bottom sequential order must the ACL entries be placed on the interface to enforce this security policy without rule shadowing?

A network administrator is designing security controls for transmitting sensitive corporate financial records between two remote office sites over an untrusted public network. The controls must ensure that unauthorized parties cannot intercept and read the data, and that any tampering during transit is immediately detected. Which TWO of the following technical mechanisms should the administrator implement to satisfy these requirements? (Select TWO.)

A network security engineer is deploying a remote access VPN solution using L2TP over IPsec (L2TP/IPsec) to support remote workers connecting from behind residential NAT routers. Authentication will be offloaded to a central enterprise AAA server. Which of the following port and protocol configurations must be permitted on the network firewalls and VPN gateway to ensure successful connection establishment and authentication? (Select TWO.)

An organization is deploying an enterprise remote access VPN solution for mobile users who frequently operate behind Carrier-Grade NAT (CGNAT) and restrictive corporate firewalls. The network security team requires mutual certificate authentication, complete confidentiality of internal IP headers, and seamless NAT traversal without dropping integrity checks. Which of the following technical configurations and protocol mechanisms must be selected to satisfy these requirements? (Select TWO.)

A network administrator needs to construct an IPv4 extended Access Control List (ACL) to filter traffic originating from the internal subnet $192.168.1.0/24$. The security policy requires the following requirements in order of processing:
1. Allow host $192.168.1.25$ to access web server $10.10.10.5$ using secure HTTPS (port 443).
2. Block all other hosts on the $192.168.1.0/24$ subnet from reaching server $10.10.10.5$.
3. Permit all remaining outbound traffic from subnet $192.168.1.0/24$ to any other destination.
4. Catch and drop all remaining unspecified IP traffic.

In what order should these ACL statements be evaluated from top to bottom to satisfy the security policy without shadowing any rules?

A network engineer is configuring a centralized AAA server to support 802.1X port-based network access control across an enterprise wireless deployment. Which configuration parameters accurately specify the default transport protocol and port assignments required for standard RADIUS authentication and accounting services?

A system auditor observes that malicious encrypted TLS command-and-control (C2) traffic traversing an internal server VLAN went completely undetected by a newly installed Network Intrusion Detection System (NIDS) connected to a core switch SPAN port. The organization requires a security solution that can inspect host system calls, file integrity changes, and decrypted application memory buffers on critical servers without altering network physical cabling or introducing a single point of failure that causes latency on the switch hardware. Which solution should be implemented to fulfill these security and architectural requirements?

A network administrator is designing a secure transport mechanism for automated database replication traffic sent between two geographically separated data centers over the public internet. The design must specifically ensure both the confidentiality of the database records and the integrity of the data while in transit. Which TWO of the following technical controls should the administrator implement to satisfy these core security objectives?

A network administrator configures a clientless SSL/TLS VPN on the corporate gateway to allow remote contractors access to internal management applications. The contractors can successfully authenticate and access internal web portals using their web browsers. However, they report being unable to connect to internal servers using native SSH desktop applications. Which of the following best explains why native SSH sessions fail in this deployment?

A network security administrator is organizing the organization's access control architecture. Match each authentication protocol or framework to its correct operational characteristic and transport mechanism.

A network technician is configuring a centralized authentication protocol for remote access VPN clients. Which protocol encrypts only the password within the packet payload and operates over UDP?