Lecture 3 pt 1.

Question 1

What is NIST? What are the benefits of its approach?

Answer 1

It’s a layered approach to security. If an attacker breaks through one layer, there are more layers protecting the system

Question 2

Can you have redundancy with standalone installations?

Answer 2

Yes

Question 3

Can you have automatic failover with standalone firewalls?

Answer 3

No

Question 4

What does Checkpoint provide over Fortinet?

Answer 4

Application Control
Identity-Based Security Policies
Centralized Management

Question 5

Name the 4 things we track to monitor NGFW performance

Answer 5

Throughput
Latency
Session Counts
CPU and Memory Usage

Question 6

Name this: Measures the amount of data the firewall can process within a given time frame

Answer 6

Throughput

Question 7

Name this: The time it takes for a packet to pass through the firewall

Answer 7

Latency

Question 8

Name this: This can affect the performance of time-sensitive applications

Answer 8

Latency

Question 9

Name this: We monitor this to ensure the firewall is not overwhelmed

Answer 9

Session Counts

Question 10

What do the session counts tell us?

Answer 10

The number of concurrent sessions the firewall is handling

Question 11

We also monitor the CPU and Memory usage for the firewall. What can High usage indicate?

Answer 11

The firewall is under stress and may become a bottleneck

Question 12

Name 3 important things when managing NGFW policies for complex enterprise environments

Answer 12

1. Centralized Management
2. Segmentation
3. Compliance checks

Question 13

Name this important thing for managing a NGFW:
Provides a unified view and control over firewall rules across the entire network

Answer 13

Centralized Management

Question 14

Name this important thing for managing a NGFW:
Divide the network into domains/segments to increase security and reduce complexity

Answer 14

Segmentation

Question 15

Name this important thing for managing a NGFW:
Regularly ensure that the firewall policies and security configurations adhere to industry regulations, legal requirements, and internal security policies

Answer 15

Compliance checks

Question 16

Separating _______ ________ (security gateways) from ___________ functions (policy control, logging, and monitoring) increases performance, _________, and scalability

Answer 16

firewall functions; management; isolation

Question 17

T/F - By default, all Palo Alto interface come in Tap deployment mode

Answer 17

False, by default they all come in Virtual Wire mode

Question 18

Name this: when in this mode, Palo Alto supports decryption, app-identification, content-identification, user-identification, and NAT

Answer 18

Virtual Wire mode

Question 19

Name the 4 deployment modes of Palo Alto

Answer 19

Tap, Virtual Wire, Layer 2, Layer 3

Question 20

T/F - Layer 2 deployment allows the configuration of multiple interfaces

Answer 20

True