Network Security

A network security engineer is designing an automated system to transmit high-value financial transaction logs between remote data centers across a public network. The security baseline specifies that the system must ensure data cannot be altered during transit without detection, while also cryptographically preventing the sending system from denying it originated the log transmission. Which of the following security mechanisms should the engineer implement to fulfill these specific security principles? (Select TWO.)

A network security administrator is evaluating centralized AAA protocols to manage enterprise infrastructure. The design requires implementing TACACS+ for device administration and RADIUS for network access control. Which TWO of the following characteristics accurately differentiate the operational behavior of TACACS+ from RADIUS? (Select TWO.)

During an incident investigation on an enterprise dual-stack subnet, a network administrator observes that workstations are directing outbound traffic to an unauthorized device on the local segment. Packet captures indicate that while Dynamic ARP Inspection (DAI) and DHCP Snooping are active and successfully blocking rogue IPv4 gateway announcements, client dual-stack nodes have automatically updated their default gateway settings to a link-local IPv6 address transmitted via unsolicited ICMPv6 Type 134 messages from an unknown host. Which of the following attack vectors is occurring, and what is the primary Layer 2 mitigation required to block it?

A security engineer is tasked with monitoring a high-traffic enterprise network segment to identify zero-day attacks and unauthorized behavioral deviations. The organization requires that the monitoring solution must not introduce processing latency, drop legitimate packets during peak traffic hours, or create a single point of failure on the link. Which deployment architecture and detection method should the engineer implement?

A network security specialist is implementing an 802.1X Port-based Network Access Control architecture across an enterprise Ethernet infrastructure. In this deployment, network switches operate as authenticators that relay authentication requests from supplicants to a centralized backend server. Which TWO of the following statements accurately describe the operational and security characteristics of the RADIUS protocol in this AAA environment?

A network administrator needs to allow remote employees to securely access internal web applications using only a standard web browser, without requiring any dedicated software installation on user endpoints. Which remote access VPN technology best satisfies this requirement?

Match each wireless security standard on the left with its primary encryption cipher or key exchange protocol on the right.

A system architect is upgrading a research organization's WLAN infrastructure to protect sensitive data transfers. The security policy mandates centralized per-user authentication integrated with an identity provider, mutual authentication between clients and RADIUS servers, and resistance against credential theft via offline dictionary attacks. Which of the following technical requirements and protocol implementations must be selected to satisfy this policy? (Select TWO.)

A network security architect is evaluating security enforcement mechanisms across an enterprise infrastructure. Match each intrusion detection/prevention architecture and engine mechanism on the left to its distinct operational characteristic or structural limitation on the right.

A network security administrator is tasked with deploying a wireless network across a financial organization's operations center. Executive policy mandates strict compliance with 192-bit cryptographic strength for all payload encryption, mandatory Protected Management Frames (PMF), and centralized identity validation through a RADIUS infrastructure using digital certificates. Which wireless security suite and cipher implementation must the administrator select to satisfy all organizational security mandates?

A network security engineer is designing an intrusion prevention architecture for a high-frequency trading firm's REST API gateway. The gateway receives TLS 1.3 encrypted HTTP/2 traffic routed asymmetrically across dual active-active Internet edge links. The firm requires active, real-time blocking of unknown zero-day application exploits, strict adherence to sub-millisecond added network latency limits ($< 1\text{ ms}$), and complete protection against session dropping caused by asymmetric TCP packet paths. Which deployment model and inspection mechanism best fulfills all system requirements?

A network security engineer configures an extended stateless IPv4 Access Control List (ACL) applied inbound on a perimeter router interface (`GigabitEthernet0/1`) to filter incoming Internet traffic. The ACL contains the following sequential rules:

- Rule 10: `permit tcp any eq 443 192.168.50.0 0.0.0.255 established`
- Rule 20: `permit tcp any host 192.168.50.10 eq 443`
- Rule 30: `permit udp 192.168.50.0 0.0.0.255 eq 53 any`

An external host with IP address $198.51.100.42$ sends an unsolicited TCP SYN packet (initial connection request) with source port $443$ to an internal host at $192.168.50.25$ on destination port $8080$.

Which action does the router take when processing this incoming TCP SYN packet?

A network security administrator is mapping enterprise authentication protocols and frameworks to their core operational characteristics. Match each authentication protocol or framework on the left with its correct operational description on the right.

A network technician is documenting security controls across an enterprise network infrastructure. Match each intrusion detection or prevention system deployment on the left with its defining operational capability or structural characteristic on the right.

A network administrator configures a standard router Access Control List (ACL) to permit web traffic to an internal server. After applying the rule, the administrator observes that all other inbound network traffic to that interface is blocked, even though no specific deny statements were explicitly written. Which of the following explains this behavior?

An enterprise network security administrator is establishing a secure procedure for receiving automated network device configuration updates from third-party vendor systems over an open network. The security policy dictates that the system must guarantee the configuration payload has not been modified during transmission and must also ensure that the vendor cannot deny having created and sent the specific configuration update. Which of the following mechanisms best fulfills both of these security requirements?

A network administrator is deploying a centralized authentication mechanism to manage administrative access to enterprise switches. The security policy mandates that every shell command executed by network personnel must be authorized on an individual, per-command basis, and all communication between the network switches and the AAA server must encrypt the entire packet body. Which protocol should the administrator implement to satisfy these requirements?

An enterprise network architect is evaluating security controls across a multi-tier network deployment. Match each technical implementation on the left with the core security principle or objective it primarily satisfies on the right.

A network security analyst is investigating simultaneous security alerts on two separate VLANs within an enterprise network. On VLAN 20, client workstations attempting to reach the internal ERP server (10.20.4.50) present browser certificate warnings. Packet captures on VLAN 20 show a flood of unsolicited ARP responses associating the default gateway IP address (10.20.4.1) with the MAC address of an unrecognized host on the local segment. On VLAN 30, clients resolving the hostname erp.corporate.local receive IP address 198.51.100.44 (an external host) instead of 10.20.4.50. Packet captures on VLAN 30 reveal forged UDP port 53 responses arriving prior to replies from the legitimate internal DNS server, with no abnormal Layer 2 ARP activity detected. Which of the following correctly identifies the distinct attack vectors operating on VLAN 20 and VLAN 30, respectively?

A network technician is configuring an Access Control List (ACL) on a router interface to allow web traffic to an internal web server at 192.168.1.50 via HTTPS (TCP port 443). The technician adds an explicit rule permitting this traffic. However, after applying the ACL, all other network traffic passing through the interface is immediately blocked, despite no explicit deny rules being added to the configuration. Which fundamental ACL feature causes this automatic blocking behavior?