200-201 exam dumps: questions 101 to 200 of 403

Correct answers: A, C, D

• A. Correct.

  Correct: NetFlow provides detailed information about the source and destination IP addresses, which helps identify the endpoints involved in communication.

• B. Incorrect.

  Incorrect: NetFlow does not capture packet payload content; it focuses on metadata about the network flow, not the data itself.

• C. Correct.

  Correct: NetFlow includes information on the volume of data transferred between a source and destination, enabling insights into traffic patterns.

• D. Correct.

  Correct: NetFlow provides protocol-level details such as whether the traffic is TCP, UDP, or other protocols, which is crucial for understanding the type of communication.

• E. Incorrect.

  Incorrect: While additional tools can infer geographical locations from IP addresses, NetFlow itself does not provide geographical information.

Correct answers: A, B, C, E

• A. Correct.

  Application visibility and control is a key feature of NGFWs that allows granular control over specific applications, ensuring security and performance.

• B. Correct.

  NGFWs often include an Intrusion Prevention System (IPS) to detect and block advanced threats in real-time.

• C. Correct.

  URL filtering helps block access to malicious or non-compliant websites, which is an important security feature of NGFWs.

• D. Incorrect.

  Packet filtering based solely on source and destination IP addresses is a feature of traditional firewalls, not NGFWs, and lacks advanced threat detection capabilities.

• E. Correct.

  User identity-based access control enables the NGFW to enforce policies based on user roles, providing enhanced security and compliance.

Correct answer: C

• A. Incorrect.

  Application Layer Filtering is used to control traffic based on application-level data, but it does not address encrypted traffic specifically.

• B. Incorrect.

  Deep Packet Inspection (DPI) enables advanced traffic analysis but cannot inspect encrypted traffic unless decryption is performed.

• C. Correct.

  SSL/TLS Decryption is the correct feature as it allows the NGFW to decrypt, inspect, and re-encrypt traffic to detect threats within encrypted data.

• D. Incorrect.

  Intrusion Prevention System (IPS) focuses on identifying and blocking known threats but does not inherently provide the capability to handle encrypted traffic.

Correct answer: C

• A. Incorrect.

  This is incorrect because a stateful firewall does support HTTP traffic over non-standard ports if the rules are configured accordingly.

• B. Incorrect.

  This is incorrect because stateful firewalls can allow inbound traffic if it is part of an expected response to an outbound request.

• C. Correct.

  This is correct because the firewall rules need to explicitly allow outbound traffic on port 8080 for HTTP requests to the web server to pass through.

• D. Incorrect.

  This is incorrect as stateful firewalls track connections for all protocols, including those using non-standard ports.

Correct answers: A, C, E

• A. Correct.

  Traditional stateful firewalls do not inspect application-layer data, so they cannot detect specific malicious payloads such as SQL injection in HTTP requests.

• B. Incorrect.

  Stateful firewalls can effectively block traffic based on IP address and port using access control lists (ACLs).

• C. Correct.

  Encrypted HTTPS traffic cannot be inspected by traditional stateful firewalls unless decryption is performed, which is beyond their capabilities.

• D. Incorrect.

  Stateful firewalls are designed to track the state of TCP connections, so they can effectively monitor and allow traffic matching established TCP connections.

• E. Correct.

  Traditional stateful firewalls do not inspect application-layer protocols like DNS. They only operate at Layers 3 and 4 (IP and transport layers).