Network Security

A network administrator wants to centralize administrative access to enterprise routers and switches. The administrator requires a security protocol that encrypts the entire packet payload—including all authentication details and command data—and utilizes TCP port 49 for reliable transport. Which protocol best satisfies these requirements?

A network security administrator needs to monitor traffic destined for a cluster of internal database servers to identify malicious payload patterns. The solution must ensure that security monitoring introduces zero processing latency to live database transactions and cannot interrupt network traffic if the monitoring device fails or experiences a hardware fault. Which of the following deployment options best satisfies these requirements?

A network security administrator must construct an extended IPv4 Access Control List (ACL) on an ingress router interface serving the internal subnet $10.50.10.0/24$. The ACL must enforce five security requirements using first-match evaluation logic without rule shadowing:

1. Quarantine host $10.50.10.45$ by blocking all of its outbound traffic.
2. Allow database administrative hosts in the $10.50.10.0/26$ subnet to access a central database server at $192.168.100.50$ on TCP port $3306$.
3. Deny all other hosts in $10.50.10.0/24$ access to any server in the $192.168.100.0/24$ network.
4. Permit all remaining hosts in $10.50.10.0/24$ to access external web servers on TCP port $443$.
5. Explicitly deny and log all unapproved IPv4 traffic originating from $10.50.10.0/24$.

Arrange the given ACL statements in the correct top-to-bottom sequential order (from index $10$ to $50$) to fulfill these security requirements accurately.

A network security administrator is updating wireless security configurations across multiple corporate site tiers to meet strict security baseline policies. Match each wireless security standard or mode on the left with its corresponding encryption protocol and authentication mechanism on the right.

A network administrator needs to implement a basic IPv4 Access Control List (ACL) to filter traffic entering a router interface. Place the following steps in the correct sequential order from first to last to properly configure and activate the firewall ACL.

A enterprise network security architect is updating the organization's defensive baseline to ensure alignment with core security architecture principles. Match each operational technical control on the left with the primary security pillar or principle it directly satisfies on the right.

An enterprise deploys active inline Network Intrusion Prevention System (NIPS) appliances on two parallel border gateway links configured for active-active asymmetric routing. Shortly after deployment, users experience intermittent session terminations and dropped connections on legitimate TCP applications. Packet inspection reveals that outbound TCP SYN packets traverse Link 1 (monitored by NIPS 1), while the corresponding SYN-ACK return packets traverse Link 2 (monitored by NIPS 2), causing NIPS 2 to drop the return packets as invalid out-of-state traffic. Which of the following architectural adjustments will eliminate these session drops while maintaining active inline threat prevention across both links?

Match each core security principle on the left with its corresponding primary objective on the right.

A network security auditor discovers that administrative session logs for network switches expose executed CLI command parameters in cleartext across the management network. Furthermore, the existing AAA deployment cannot restrict specific administrative commands per role because authentication and authorization are tightly coupled into a single transaction. Which AAA protocol implementation directly resolves both findings by encrypting the complete packet payload and decoupling authorization from authentication?

A network administrator configures an Access Control List (ACL) with explicit permit statements for HTTP and HTTPS traffic on a router interface. However, users report that all other traffic attempting to pass through this interface is blocked, even though no deny statements were explicitly written. Which of the following features accounts for this behavior?

A network administrator needs to verify that downloaded firmware updates have not been corrupted or tampered with in transit, while also ensuring that administrative login sessions to core switches are strictly limited to authorized staff. Which TWO security concepts or mechanisms directly address these requirements? (Select TWO.)

A network administrator is implementing TACACS+ for centralized management of network devices. Which TWO of the following operational characteristics accurately describe TACACS+? (Select TWO)

A network security administrator configures full-disk encryption on all corporate laptops to ensure that sensitive files cannot be accessed if a laptop is lost or stolen. Which pillar of the CIA triad does this security control directly uphold?

A network administrator is setting up a wireless network for a business environment. The company policy mandates that each employee must authenticate with their own unique credentials using a central RADIUS server, rather than sharing a single password across the organization. Which of the following wireless security modes best fulfills this requirement?

A network engineer is configuring a centralized backend authentication server to support 802.1X port-based network access control across wireless access points in an enterprise network. The architecture requires a standard protocol to handle authentication and authorization requests forwarded by the wireless access points acting as authenticators. Which protocol and transport layer configuration correctly fulfills this network access control deployment?

A network administrator is designing a wireless security architecture for an enterprise office. The organizational policy mandates centralized user authentication using 802.1X/RADIUS, individual credential accounting, and strict enterprise-grade encryption key management. A junior technician proposes implementing WPA3-Personal with Simultaneous Authentication of Equals (SAE) using a complex 30-character passphrase, arguing it avoids RADIUS server deployment while providing equal security. Which of the following best evaluates the junior technician's proposal?

An organization is enhancing its security monitoring architecture to detect zero-day exploits and analyze encrypted network application traffic. The network engineering team decides to deploy Host-based Intrusion Detection Systems (HIDS) across critical endpoints. Which of the following capabilities represent distinct operational advantages of a HIDS compared to a passive Network Intrusion Detection System (NIDS)? (Select TWO.)

A technician is deploying a wireless access point and needs to select security protocols that protect against offline dictionary password-guessing attacks while providing modern, high-strength data encryption. Which of the following wireless security standards or mechanisms fulfill these requirements? (Select TWO.)

During a forensic analysis at a financial services organization, network engineers discover that an attacker executed a man-in-the-middle attack on an internal subnet between an application server and a SQL database. The attacker intercepted automated database queries and modified financial balances inside the packet payloads in transit without interrupting the TCP session or altering packet lengths. System uptime, server access, and network performance remained completely normal throughout the event. Which security principle of the CIA triad was directly violated, and which security control best mitigates this vulnerability?

An administrator is configuring a stateless extended IPv4 Access Control List (ACL) on a WAN edge router interface (GigabitEthernet0/1) to secure traffic between an internal database cluster ($192.168.10.0/24$) and a remote external cloud database server ($203.0.113.50$). Internal hosts initiate outbound TCP connections to the external server on destination port $5432$.

To allow outbound traffic, the outbound ACL on GigabitEthernet0/1 contains the following rule:
`access-list 101 permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.50 eq 5432`

Which entry must be added to the inbound ACL on GigabitEthernet0/1 to permit return traffic from the database server back to internal hosts while preventing unrequested inbound TCP connections from external sources?