SY0-701 exam dumps: questions 201 to 300 of 490

Correct answer: A

• A. Correct.

  Correct. An NGFW is well suited for perimeter deployment when the organization needs application awareness, deeper inspection, and visibility into traffic, including capabilities commonly associated with controlling applications and inspecting encrypted traffic depending on configuration and licensing. A WAF remains the best specialized control for protecting web applications against attacks such as SQL injection and cross-site scripting because it understands HTTP/HTTPS requests and common web attack patterns. This layered approach matches real-world best practice: use an NGFW for broad network/perimeter security and a WAF for application-layer web protection.

• B. Incorrect.

  Incorrect. A layer 4 firewall primarily makes decisions based on IP addresses, ports, and protocols, which is not sufficient to identify or stop application-layer attacks such as SQL injection or cross-site scripting. Removing a WAF would eliminate the control most specifically designed to inspect HTTP/HTTPS payloads for malicious web requests. This option reflects the misconception that transport-layer filtering can adequately protect modern web applications.

• C. Incorrect.

  Incorrect. A UTM appliance can consolidate multiple security functions into one platform and may be appropriate for some environments, especially smaller organizations, but it is not the best answer here because the scenario explicitly calls for maintaining the specialized control best suited to protect the web application itself. Replacing application-specific web protections with only a UTM introduces risk because a dedicated WAF provides focused defenses for web-layer attacks that perimeter consolidation alone may not address with the same depth.

• D. Incorrect.

  Incorrect. This option mixes concepts inaccurately. Layer 7 inspection can provide more context than layer 4, but simply relying on a perimeter device alone is not the most appropriate defense against SQL injection in a web application. A WAF is specifically designed to analyze and filter HTTP/HTTPS requests for malicious patterns targeting web applications. The misconception here is that any device with some application-layer awareness can fully replace a dedicated WAF.

Correct answer: A

• A. Correct.

  Correct. An inline active device sits directly in the traffic path and can inspect and take action, such as blocking or dropping malicious requests before they reach the web application. This matches the requirement to actively stop suspicious traffic. For the core switch monitoring use case, a passive monitor connected through a network tap or a switch SPAN/mirror port can observe traffic without being part of the live forwarding path, which avoids adding latency and reduces the risk of becoming a single point of failure.

• B. Incorrect.

  Incorrect. A passive monitor for the web application can observe and alert on malicious traffic, but it cannot directly prevent the traffic from reaching the servers because it is not enforcing inline. The second part is also flawed: placing an inline active device at the core switch would insert the tool into the production path, which conflicts with the requirement to avoid added latency and avoid creating a point of failure just for monitoring.

• C. Incorrect.

  Incorrect. Inline placement means the device is in the traffic path, so it can affect traffic flow, latency, and availability. Calling such devices 'inline passive' is misleading in this context. If a device is truly passive for monitoring, it is typically out of band and receives copied traffic from a tap or mirror port rather than forwarding production traffic itself.

• D. Incorrect.

  Incorrect. A network tap is generally used to copy traffic for monitoring and analysis; it does not normally block malicious traffic as a security control. The phrase 'active tap devices' combines concepts incorrectly. If the goal is to block traffic, the device must be inline and capable of active enforcement, such as an IPS or WAF deployed in the traffic path.

Correct answer: A

• A. Correct.

  Correct. An active security device, such as an inline IPS, sits directly in the traffic path and can take preventive action like dropping packets, resetting connections, or blocking traffic in real time. The tradeoff is that inline placement introduces potential latency and can create an availability concern if the device fails, is misconfigured, or is undersized. This directly matches the scenario's need for immediate blocking while acknowledging the network team's concern.

• B. Incorrect.

  Incorrect. A passive device connected through a tap receives a copy of traffic for analysis but is not in the path of traffic flow. Because it is out of band, it generally cannot directly block packets traversing the link. This option reflects a common misconception that visibility alone enables prevention.

• C. Incorrect.

  Incorrect. Port mirroring, like a network tap, is typically used for passive monitoring by sending copies of packets to a sensor. A passive device connected this way can detect and alert on malicious activity, but it cannot directly drop packets before they traverse the link. Someone might choose this option because SPAN/port mirroring is often associated with IDS deployments, but IDS monitoring is detective rather than preventive unless integrated with other enforcement controls.

• D. Incorrect.

  Incorrect. A network tap is used to feed copied traffic to monitoring tools and supports passive visibility. An active device must be inline to directly enforce blocking on the traffic stream. While some platforms can send commands to other devices for response, that is not the same as directly terminating sessions from a passive tap position on the monitored link.

Correct answer: A

• A. Correct.

  Correct. A network-based intrusion prevention system (IPS) is designed to inspect traffic inline and can actively block malicious requests, such as known SQL injection patterns, before they reach the protected servers. This directly satisfies the requirement to both detect and stop attacks in real time without modifying the application itself.

• B. Incorrect.

  Incorrect. A jump server is used to control and secure administrative access to internal systems, typically by serving as a hardened intermediary for remote management. It does not inspect or block customer HTTP requests to a public web application, so it would not mitigate SQL injection attempts from external attackers.

• C. Incorrect.

  Incorrect. A proxy server can intermediate requests, enforce policy, or cache content depending on its role, but a generic proxy's primary purpose is not inline attack prevention. While some specialized reverse proxies may provide security features, the best answer in this scenario is an IPS because the requirement is specifically to detect and automatically block malicious traffic before it reaches the servers.

• D. Incorrect.

  Incorrect. Sensors are commonly used for monitoring and visibility, often feeding data to IDS, SIEM, or other analysis platforms. However, sensors alone generally observe and report activity rather than actively prevent malicious traffic. They would help with detection and forensic review, but not with stopping the attack in real time.

Correct answer: C

• A. Incorrect.

  A jump server is used to provide controlled administrative access to internal systems, typically by acting as a hardened intermediary for remote management. It is not designed to inspect and block malicious application traffic such as SQL injection attempts targeting public web servers.

• B. Incorrect.

  A proxy server can mediate client requests and may provide filtering, caching, or anonymity features depending on the implementation. However, a generic proxy server is not the best answer here because the requirement is specifically to automatically detect and block malicious traffic patterns before they reach the servers. That is the primary role of an IPS.

• C. Correct.

  An intrusion prevention system (IPS) is correct because it is designed to inspect traffic inline and take preventive action, such as dropping or rejecting malicious packets or sessions. In this scenario, the company needs a control that both detects SQL injection attempts and stops them before they reach the web application, which aligns with IPS functionality.

• D. Incorrect.

  A network sensor connected to a monitoring port is typically used for visibility, traffic collection, or detection when paired with monitoring tools, but by itself it is generally out-of-band and does not block traffic. This makes it useful for alerting and analysis, not for the required automatic prevention.