Cisco Certified Support Technician (CCST) NetworkingNetworking FundamentalsHard
A network security analyst is investigating unusual outbound network traffic originating from several internal servers. The traffic appears to be communicating with unknown external IP addresses on a variety of high-numbered ports. The analyst suspects a compromised server is attempting to establish command and control (C2) communications. Which network component would be most effective for inspecting and controlling this outbound traffic based on defined security policies?
- ALayer 2 Switch
- BHub
- CFirewall
- DRepeater
Show answer & explanationAnswer & explanation
Correct answer: C. Firewall
A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies. It is specifically designed to control access between networks and can block unauthorized outbound connections, such as those used for C2 communications.
Why the other options are wrong
- A. A Layer 2 switch forwards traffic based on MAC addresses within a local network segment and does not perform deep packet inspection or enforce security policies at the IP/port level for outbound control.
- B. A hub is a legacy device that simply repeats all incoming traffic to all other ports, offering no security or traffic control capabilities.
- D. A repeater regenerates a signal to extend network reach and has no intelligence for traffic inspection or security policy enforcement.
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It establishes a barrier between a trusted internal network and untrusted external networks (like the internet).
- Filters traffic based on rules (IP, port, protocol).
- Protects internal networks from external threats.
- Can be hardware, software, or cloud-based.
- Key for enforcing security policies.
Memory trick: Firewall: 'F'or 'Filtering' and 'Fortifying' the network.