Network Security

A network administrator notices that remote workers connected via a full-tunnel VPN are causing severe bandwidth saturation at the corporate perimeter by streaming internet media through the corporate gateway. To alleviate congestion, the administrator plans to modify the client configuration to allow split tunneling. Which of the following describes the primary security risk introduced by enabling split tunneling?

Match each Intrusion Detection/Prevention System (IDS/IPS) architectural model or detection mechanism on the left to its corresponding operational deployment scenario on the right.

A network technician is configuring a external perimeter firewall to permit incoming remote access VPN connections for users utilizing the Secure Socket Tunneling Protocol (SSTP). Which transport protocol and port number combination must be opened on the firewall for SSTP connections to succeed?

A lead systems engineer is establishing physical and environmental security controls across a newly constructed high-density enterprise data center. Match each specialized environmental or power control mechanism to its primary protective function.

Match each authentication protocol or network security framework to its primary operational characteristic.

During a security audit of a dual-stack enterprise LAN, network administrators discover that several IPv4-configured workstations are unexpectedly redirecting web traffic to an untrusted external IP address. Packet captures reveal that these workstations regularly receive unsolicited ICMPv6 Router Advertisement (RA) packets from a non-gateway host. These RA frames specify an unknown link-local IPv6 address as the default gateway and assign a rogue IPv6 DNS server. Which of the following statements accurately describe this network attack and its operational impact? (Select TWO.)

A network engineer is configuring a site-to-site VPN tunnel between two enterprise office locations. Unicast IP traffic successfully traverses the tunnel using standard IPsec transport. However, OSPF routing protocol neighbor adjacencies fail to form across the VPN, preventing dynamic routing updates from being exchanged. Which solution should the engineer implement to enable dynamic routing protocols across the encrypted connection?

A network administrator is conducting a post-audit baseline security hardening on an enterprise edge router. The audit report specifies three critical remediation goals: secure the administrative management plane, mitigate unauthorized VLAN hopping attacks across 802.1Q trunk links, and establish cryptographically secured remote device telemetry. Which of the following baseline configuration sets fully satisfies all three audit requirements?

An organization is enhancing the physical access controls for its core data center. Management requires a solution that strictly enforces single-person entry and prevents unauthorized individuals from tailgating behind an authenticated employee into the server hall. Which physical access control mechanism should the network administrator deploy to best satisfy this requirement?

A network security administrator is mapping recently deployed enterprise security controls to core security principles. Match each technical implementation on the left with the primary security concept or CIA triad pillar it addresses on the right.

A security technician observes traffic logs indicating an external host is conducting a half-open TCP SYN scan against a gateway firewall. Which of the following statements accurately describe the operational characteristics of a TCP SYN stealth scan? (Select TWO.)

Following an unscheduled shutdown of a secondary Computer Room Air Handler (CRAH) unit in a high-density data center, network engineers observe water droplets forming on core switch chassis enclosures and optical transceiver modules. To compensate for the reduced cooling capacity, the remaining active CRAH unit automatically dropped its discharge air supply temperature to $10^\circ\text{C}$ ($50^\circ\text{F}$) while maintaining a relative humidity setpoint of $70\%$. Which environmental mechanism directly accounts for the moisture condensation on the operating network hardware?

A network technician needs to safeguard a remote equipment room against electrostatic discharge (ESD) and prevent unauthorized physical tampering with individual server hardware inside shared enclosures. Which TWO of the following controls should be deployed to meet these specific requirements? (Select TWO)

Which defining operational characteristic correctly corresponds to each authentication protocol or Extensible Authentication Protocol (EAP) framework variant?

An enterprise auditor notes during a compliance review that network administrative changes executed via SSH on core switches cannot be restricted per individual CLI command using the organization's existing remote access protocol. Additionally, security policy mandates encrypting the entire packet body during AAA communications. Which protocol should be deployed on the network devices to satisfy these authorization and encryption requirements?

A network administrator is deploying an extended IPv4 Access Control List (ACL) on a router interface connecting an internal client subnet ($10.50.100.0/24$) to an external management network ($192.168.200.0/24$). The filtering device operates as a stateless packet filter. Which of the following configuration requirements and operational behaviors apply to this scenario? (Select TWO.)

A network administrator receives an automated threshold notification indicating that ambient heat in a remote wiring closet has risen above $30^\circ\text{C}$ ($86^\circ\text{F}$). Which physical environmental monitoring component is directly responsible for measuring atmospheric conditions and triggering this alert?

An organization's network monitoring tool alerts administrators to an overwhelming volume of unsolicited UDP responses originating from public DNS servers, all targeted at a single internal web server. Investigation reveals that an external attacker sent small DNS requests with a spoofed source IP address corresponding to the target server. Which of the following network attack vectors is being executed?

Match each secure remote access protocol or configuration feature on the left with its corresponding primary technical capability on the right.

A network administrator is deploying a secure Wi-Fi network for a corporate office where each employee must authenticate using their unique Active Directory credentials managed by a central RADIUS server. The organization requires using the WPA3 standard. Which wireless security mode and authentication mechanism combination should the administrator configure on the access points?