Network Security

A network security administrator needs to implement a security solution that continuously monitors network traffic and actively drops malicious packets in real time before they can reach critical application servers. Which device type and deployment configuration best fulfills these requirements?

A network security architect is reviewing enterprise controls to align with core security principles across a hybrid multi-cloud environment. Match each technical security mechanism to the primary security principle of the CIA Triad or expanded core concepts it directly fulfills.

A network administrator configures an inbound extended Access Control List (ACL) on a router interface (GigabitEthernet0/0) to allow internal workstations on subnet 172.16.10.0/24 to browse secure external websites and perform domain name resolution. The applied ACL rules are evaluated top-down as follows:

Although outbound TCP SYN packets sent to external Web servers successfully pass through the router interface, internal clients report that HTTPS web pages fail to load and connections instantly time out. Outbound interface NAT and default routing are verified to be fully operational.

Which technical requirement of stateless access control filtering explains why these HTTPS connections fail to establish?

A network security architect must implement centralized AAA management for network administrators executing commands on enterprise routers across loss-prone WAN links. The solution must support per-command authorization policy enforcement, encrypt the entire packet payload during transit, and use a reliable connection-oriented transport protocol to guarantee delivery of accounting records. Which protocol and transport combination should the architect deploy?

Following a workstation compromise, an enterprise security team observes that an internal database server receives encrypted command-and-control traffic, accompanied by unauthorized local process injection and file integrity alterations. The existing network-based IDS connected via a switch SPAN port failed to decrypt the payload and was structurally incapable of stopping the local system modifications due to its passive out-of-band placement. To actively block unauthorized system calls, memory manipulation, and malicious file modifications directly on the server host, which security technology should be deployed?

A company is updating its perimeter network architecture to defend against automated exploit attacks targeted at public-facing application servers. The security strategy requires a device positioned directly in the traffic flow that can inspect packet payloads in real time and automatically drop malicious frames before they cross into the internal segment. Which security appliance deployment best satisfies these active mitigation requirements?

A network security analyst is investigating a compromised corporate subnet where users attempting to access internal file servers are periodically redirected to an unauthorized external server capturing credentials. A packet capture analysis on the local segment reveals two distinct operational anomalies:
1. Unsolicited, continuous ARP response frames broadcast across the segment, binding the subnet default gateway's IP address to an unrecognized host's MAC address.
2. Injected response packets intercepting local recursive name resolution requests and supplying spoofed IP addresses for internal domain names.

Which of the following attack vectors are directly being executed in this enterprise incident? (Select TWO)

A network security administrator is transitioning core switch infrastructure management from a RADIUS solution to TACACS+. When auditing protocol behavior and firewall traffic rules for TACACS+, which of the following operational characteristics accurately describe TACACS+ compared to RADIUS? (Select TWO)

A network security team observes severe throughput degradation and dropped legitimate traffic on an inline Network Intrusion Prevention System (NIPS) during peak hours. The NIPS performs deep packet inspection and signature matching on unencrypted perimeter traffic. Concurrently, an audit reveals that internal attackers are transmitting malicious encrypted payloads across TLS sessions that bypass the NIPS undetected. Which of the following architectural modifications best addresses the processing bottleneck while providing threat visibility into the encrypted traffic?

A network security administrator configures a passive Network Intrusion Detection System (NIDS) connected to a switch port mirroring session. While the system successfully logs alert notifications for unauthorized port scans, it does not stop the scanning traffic from reaching internal hosts. Which architectural characteristic explains why the NIDS cannot directly drop these attack packets?

Match each AAA framework component or access control concept on the left to its corresponding operational description on the right.

An enterprise security team is deploying 802.1X port-based network access control across corporate network switches. In this architecture, the edge switch serves as the authenticator and relays Extensible Authentication Protocol (EAP) messages between the client host and a centralized authentication server. Which protocol is primarily utilized between the switch and the authentication server to transport these encapsulated EAP packets?

Match each core security principle of the CIA triad to its primary operational objective.

Match each wireless security standard on the left with its primary encryption algorithm or cipher suite on the right.

A healthcare organization experiences an outage on its web-based patient portal after a misconfigured network backup script fails to clear temporary files, causing the primary storage volume to fill completely and crashing the service. Although all patient records remained securely encrypted at rest and no data was accessed or altered by unauthorized parties, clinical staff were unable to access critical patient records for three hours. Which pillar of the CIA triad was directly compromised in this incident?

A network administrator is configuring a corporate wireless network that requires individual user authentication against a central RADIUS server using WPA3-Enterprise. Which authentication framework must be implemented on the wireless network?

A senior network security analyst is reviewing telemetry logs and protocol captures across several enterprise security incidents. Match each specific network attack type to its underlying operational mechanism and observed protocol footprint.

Match each intrusion detection/prevention operational mechanism or placement scenario to its primary functionality or characteristics.

During a security incident investigation on a segmented corporate network, a technician notices that workstations on VLAN 10 are sending traffic intended for the local default gateway (10.10.10.1) directly to an unknown host's MAC address (00:50:56:AB:CD:EF). Analysis of network traffic logs reveals that the unknown host continuously transmits unsolicited Ethernet frames asserting ownership of IP address 10.10.10.1 without altering the victim clients' DNS configuration or DHCP lease parameters. Which of the following attack vectors is actively occurring, and what underlying mechanism enables this compromise?

An organization installs redundant power supplies and an Uninterruptible Power Supply (UPS) unit for its core network switches to prevent system outages during electrical disruptions. Which pillar of the CIA triad is directly supported by this implementation?