N10-009 Question 280
Select 2Security rules: Access control list (ACL), Uniform Resource Locator (URL) filtering, Content filteringA company's security team must reduce web-based risk for office users without blocking general internet access. The requirements are: block access to known malicious and gambling websites, prevent downloads of executable attachments from webmail, and deny outbound HTTP/HTTPS access from a server VLAN that should only reach approved update repositories. Which TWO controls best meet these requirements?
- A
Apply URL filtering for the user VLAN and an outbound ACL on the server VLAN that permits only approved repository destinations
- B
Configure content filtering to block executable file types and categories such as malware and gambling for user web traffic
- C
Create an inbound ACL on the edge router to block all traffic sourced from gambling websites and malicious URLs
- D
Enable port security on switch access ports to stop users from browsing to unapproved websites
- E
Use DNS round-robin to redirect requests for gambling sites to an internal warning page
Show answer and explanation
Correct answers: A, B
Explanation
The best answer is to combine URL filtering and content filtering for office users, while using an ACL to constrain server VLAN egress to only approved repositories. In practice, these requirements are often implemented on a secure web gateway, proxy, or next-generation firewall. URL filtering is appropriate for blocking categories such as gambling and known malicious sites. Content filtering is appropriate for blocking specific file types, such as executables delivered through webmail. ACLs remain valuable for network-layer enforcement, especially for limiting server subnets to specific destinations, ports, and protocols.
This aligns with common Network+ security-rule concepts and vendor best practices: ACLs operate primarily at Layers 3 and 4 for permit/deny decisions based on IPs, protocols, and ports; URL filtering controls access to sites by URL, domain, reputation, or category; and content filtering examines content characteristics such as MIME type, attachment type, or category to block undesirable material. A layered approach is recommended in enterprise security guidance because no single control addresses destination restriction, category-based browsing control, and file-type blocking equally well.
- A. Correct.
Correct. URL filtering is designed to allow or deny access based on website categories, reputation, or specific URLs/domains, which fits the requirement to block malicious and gambling sites for office users. An outbound ACL on the server VLAN is also appropriate because ACLs can restrict which destination IPs, ports, and protocols servers are allowed to reach. That supports the requirement that servers should only access approved update repositories over HTTP/HTTPS rather than having general web access.
- B. Correct.
Correct. Content filtering is the best fit for inspecting and controlling web content types, including blocking downloads of executable files from webmail or other web sources. Many secure web gateways and next-generation firewalls use content filtering to enforce file-type restrictions and category-based web controls together with URL filtering. This directly addresses the requirement to prevent executable attachment downloads while still allowing general internet access.
- C. Incorrect.
Incorrect. ACLs on routers and firewalls filter based on Layer 3/Layer 4 information such as source/destination IP, protocol, and port, not URL strings or website categories. Also, an inbound ACL blocking traffic sourced from gambling websites does not solve the user's outbound browsing problem, because the issue is users initiating connections to those destinations. This option reflects the common misconception that ACLs can natively filter URLs the way a proxy or web filter can.
- D. Incorrect.
Incorrect. Port security limits which MAC addresses can connect to a switch port and can disable a port if unauthorized devices appear. It does not evaluate web destinations, URLs, file types, or content categories. Someone might choose this option because it is a security feature on switches, but it is unrelated to web access control requirements.
- E. Incorrect.
Incorrect. DNS round-robin is a load-balancing technique for distributing requests across multiple hosts. It is not a security control for filtering URLs or content. Although DNS-based controls can sometimes redirect or sinkhole domains in certain security products, plain DNS round-robin does not provide the required category-based blocking or file-type inspection.