Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Secure Network ComponentsSwitch
All CISSP topics

4.0 Communication and Network Security

Secure Network Components Practice Questions

Firewalls, IDS/IPS, proxies, NAC, VPN and remote access, and wireless and VoIP security.

One solved question, so you can see how these are marked

A company needs to enforce policy based on user identity, application, and content while inspecting traffic that uses common web protocols. Which control is the BEST fit?

A next-generation firewall with application-aware traffic inspection policies

A next-generation firewall can combine stateful controls with application and content inspection, subject to appropriate configuration and privacy limits. A packet filter and circuit proxy operate with less application context, while a passive IDS detects but does not enforce traffic policy.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 9 Secure Network Components questions in this set

Answers and explanations appear when you work through the set above.

  1. An organization wants to identify previously unseen command-and-control behavior that may not match a known signature. Which detection method should the security manager prioritize?

    • Signature matching against an attack-string database, with regular updates from the detection vendor
    • Anomaly or behavior analysis that flags deviations from established normal activity
    • A stateless ACL that blocks a fixed list of source addresses
    • A proxy that authenticates users before forwarding requests

  2. A security architect places a server-side component between clients and Internet destinations so that clients do not connect directly, and the component can inspect and filter HTTP requests. What is this component primarily acting as?

    • A reverse proxy protecting an origin server from direct client connections
    • A network behavior analysis sensor monitoring mirrored traffic
    • A forward proxy inspecting and forwarding outbound HTTP for internal clients
    • A host-based firewall controlling processes on the client

  3. Before allowing a managed laptop onto a sensitive network segment, the organization must verify its identity and security posture and place noncompliant devices in remediation. Which capability BEST supports this requirement?

    • A content-filtering appliance that blocks prohibited URLs
    • A network intrusion prevention sensor deployed on a perimeter link
    • A VPN concentrator that terminates encrypted tunnels
    • NAC with authentication, posture assessment, and dynamic enforcement

  4. A remote administrator needs access to a small set of internal management systems from an untrusted home network. Which design is the MOST defensible?

    • Publish each management interface on the Internet, restrict source IP addresses, and rely on local passwords
    • Use a managed device, MFA-protected VPN or hardened gateway, and resource-level access limits
    • Publish the management interfaces through a public reverse proxy without user authentication
    • Use an encrypted VPN but grant the device unrestricted access to the entire internal network

  5. Which statement BEST distinguishes WPA3-Personal from WPA3-Enterprise?

    • WPA3-Personal: SAE with a passphrase; WPA3-Enterprise: 802.1X and EAP
    • WPA3-Personal uses WEP, while WPA3-Enterprise uses WPA2 with a shared passphrase
    • WPA3-Personal requires a RADIUS server, while WPA3-Enterprise does not support centralized authentication
    • WPA3-Personal and WPA3-Enterprise use identical authentication and key establishment methods

  6. An enterprise wants certificate-based mutual authentication for corporate Wi-Fi clients and the authentication server. Which EAP method is the BEST match?

    • EAP-MSCHAPv2, because it requires a client and server certificate
    • EAP-FAST, because its protected access credential replaces certificate validation in every deployment
    • EAP-TLS, because TLS certificates can authenticate both the client and the server
    • EAP-OTP, because a one-time password provides mutual certificate authentication

  7. A company is deploying VoIP phones on a shared data network. Which control should be the FIRST architectural priority for reducing unauthorized use and lateral movement?

    • Disable call logging and remove records from the voice servers to limit attacker visibility
    • Segment voice services and control access to call and management systems
    • Rely on the phone vendor's default administrator password because phones are specialized devices
    • Permit signaling and media from any Internet address to maximize roaming support

  8. A security manager is evaluating a cellular-connected field device that handles sensitive data. Which risk should receive the MOST attention in the network security design?

    • Cellular connectivity eliminates the need for device authentication because the carrier authenticates the subscriber
    • Carrier encryption guarantees confidentiality for the complete application path, including traffic forwarded to cloud services
    • The device is trusted whenever signal strength is high, regardless of its patch state or application credentials
    • Secure application protocols, endpoint hardening, and access control beyond carrier authentication

  9. Employees increasingly access cloud applications over HTTPS, and malware is arriving through encrypted web traffic. What is the BEST risk-informed response?

    • Block all encrypted web traffic permanently, regardless of business need
    • Use a passive signature-based network IDS without decryption, assuming its signatures can inspect encrypted web payloads directly
    • Use approved TLS inspection or a secure web gateway, with certificate governance, privacy exceptions, and endpoint trust
    • Replace the firewall with a DNS server that filters only known malicious domains