Question 1

Where is the optimal placement of a next-generation firewall (NGFW) in a containerized environment to ensure effective security for container workloads?

Options :

A : Directly between the host operating system and the container runtime.

B : Directly connected to the underlying hardware running containerized workloads.

C : At the edge of the Kubernetes cluster to inspect ingress and egress traffic.

D : Inside each container to monitor traffic at the application level.

Answer: C

Question 2

What is the primary function of DNS Security in network security?

Options :

A : To scan DNS records for sensitive data leaks and automatically remove them.

B : To prevent attackers from redirecting users to malicious domains by analyzing and blocking harmful DNS queries.

C : To ensure DNS servers are always available by providing load balancing and failover mechanisms.

D : To encrypt all DNS queries and responses to prevent eavesdropping.

Answer: B

Question 3

A network administrator is troubleshooting issues with encrypted traffic between a client and server. During the TLS handshake, the client and server exchange messages to establish a secure session. Which two of the following options correctly describe steps in the TLS handshake process? (Choose two)

Options :

A : The client sends its private key to the server for symmetric key generation.

B : The client sends a ChangeCipherSpec message to indicate readiness to switch to encrypted communication.

C : The server sends a ServerHello message containing its digital certificate.

D : The client and server agree on a cipher suite during the handshake.

E : The server sends an HMAC hash of the session keys to validate integrity.

Answer: C,D

Question 4

Which of the following data sources can Cortex XDR use to detect and investigate security incidents?

Options :

A : Only endpoint data collected from managed devices.

B : Raw packet captures from all network interfaces.

C : Firewall logs and email logs exclusively.

D : Endpoint, network, and cloud data for extended detection and response.

Answer: D

Question 5

An organization is experiencing suspicious activity on multiple endpoints. The security team needs to identify the root cause and the scope of the compromise by analyzing endpoint memory, processes, and file system changes. Which IR tool is the most appropriate for this task?

Options :

A : EDR (Endpoint Detection and Response)

B : SIEM (Security Information and Event Management)

C : Sandboxing Tool

D : DLP (Data Loss Prevention)

Answer: A