Given a scenario, modify enterprise capabilities to enhance security
Firewalls, IDS/IPS, web filtering, DNS filtering, email security, EDR/XDR, and secure protocol selection.
- Reading time
- 30 min read
- Flashcards
- 22 cards
- Practice questions
- 12 questions · 3 PBQs
This is the "which box do I deploy" objective. Given a problem, pick the capability that solves it. Most of it is recognition, but two areas carry real marks: the secure protocol/port table, and knowing what each device actually sees.
Firewalls
Stateless (packet filter)
- Judges each packet alone
- Source, destination, port, protocol
- Fast, no memory of the conversation
Stateful
- Tracks connection state
- Knows a reply belongs to a request you made
- The normal modern default
The tellStateless judges packets. Stateful understands conversations, which is why it can allow return traffic without an explicit rule.
NGFW (next-generation firewall) adds application awareness — it can distinguish Facebook chat from Facebook video, not merely "port 443". It also typically integrates IPS and TLS inspection.
WAF (web application firewall) sits in front of web applications and inspects HTTP, blocking SQL injection, XSS and similar. If a stem is about protecting a web application specifically, it is a WAF, not a network firewall.
UTM (unified threat management) bundles several functions in one appliance — convenient, but a single point of failure.
Check yourself
A public web application is being hit with SQL injection attempts. Which device most directly addresses this?
IDS and IPS
The distinction from 1.1, now with placement:
- IDS detects and alerts. Typically out-of-band, receiving a copy of traffic via a SPAN port or tap. It cannot block, but it also cannot break anything.
- IPS detects and blocks. Must be inline, in the traffic path. It can block, and a failure or false positive can break production traffic.
Signature-based detection matches known patterns — accurate for known attacks, blind to novel ones. Anomaly/behaviour-based flags deviation from normal — can catch the unknown, at the cost of more false positives.
Filtering
Web filter
Controls which sites users may reach, by URL, category or reputation. Agent-based (on the endpoint, works off-network) or centralised proxy.
DNS filtering
Blocks resolution of known-malicious domains. Cheap and highly effective, because most malware needs DNS to find its command-and-control server. Blocking the lookup breaks the connection before it starts.
Email security
SPF, DKIM and DMARC verify sender legitimacy; gateways filter spam, phishing and attachments.
The three email records are worth separating, because the exam does:
| Record | What it does |
|---|---|
| SPF | Lists which servers may send mail for the domain |
| DKIM | Cryptographically signs messages so tampering and forgery are detectable |
| DMARC | Ties SPF and DKIM together and tells receivers what to do on failure, plus where to report |
Endpoint
EDR (endpoint detection and response) monitors endpoint behaviour, detects, and enables response like isolating a host. XDR extends the same idea across endpoints, network, email and cloud — correlating across layers.
Traditional antivirus matches known signatures. EDR watches behaviour, which is how it catches malware that has never been seen before.
Secure protocols
The highest-density recall in this objective. Learn insecure→secure pairs and their ports.
| Insecure | Port | Secure | Port |
|---|---|---|---|
| FTP | 21 | FTPS / SFTP | 990 / 22 |
| Telnet | 23 | SSH | 22 |
| HTTP | 80 | HTTPS | 443 |
| SMTP | 25 | SMTPS | 587 / 465 |
| POP3 | 110 | POP3S | 995 |
| IMAP | 143 | IMAPS | 993 |
| LDAP | 389 | LDAPS | 636 |
| SNMPv1/v2 | 161 | SNMPv3 | 161 |
| DNS | 53 | DNSSEC / DoH | 53 / 443 |
SNMPv3 is the version that adds authentication and encryption — v1 and v2c send community strings in cleartext. If a stem mentions SNMP security, the answer is v3.
Check yourself
An administrator must replace Telnet for managing network devices. What should be used, and on which port?
Other capabilities
Network Access Control (NAC) checks device posture before granting network access — patch level, AV status, configuration. A non-compliant device gets quarantined to a remediation VLAN.
Port security limits which devices may connect to a switch port. 802.1X authenticates devices before granting access — the same protocol as WPA3-Enterprise in 4.1.
Jump server (bastion host) — a single hardened, heavily monitored entry point into a sensitive segment. All administrative access flows through it, so there is one thing to secure and watch instead of many.