A technician is mitigating threats to web clusters. Which of the following tools is the most appropriate for a technician to use to mitigate unwanted traffic against the web clusters' public-facing interface?
Correct Answer: D
A physical firewall is a hardware device that filters and blocks unwanted or malicious traffic from entering or leaving a network. A physical firewall can be configured with rules and policies to allow or deny traffic based on various criteria, such as source and destination IP addresses, ports, protocols, applications, etc. A physical firewall can also provide logging and monitoring capabilities to detect and prevent network attacks12.
A physical firewall is the most appropriate tool for a technician to use to mitigate threats to web clusters, which are groups of web servers that work together to provide high availability and scalability for web applications. Web clusters are often exposed to the internet and face various types of threats, such as denial-of- service (DoS) attacks, brute force attacks, SQL injection attacks, cross-site scripting (XSS) attacks, etc. A physical firewall can protect the web clusters' public-facing interface by filtering and blocking the unwanted or malicious traffic before it reaches the web servers, thus reducing the risk of compromise or downtime34.
The other options are not as effective or relevant as a physical firewall for mitigating threats to web clusters.
Device encryption is a process of transforming data into an unreadable form using a secret key, which can prevent unauthorized access to the data if the device is lost or stolen. However, device encryption does not prevent network attacks or filter traffic, and it may not apply to web clusters that use shared storage or cloud services. Intrusion detection system (IDS) is a software or hardware tool that monitors network traffic and alerts the administrator of any suspicious or malicious activity. However, IDS does not block or filter traffic, and it may not be able to prevent or stop an attack in progress. IDS is often used in conjunction with a firewall, not as a replacement. Antivirus/anti-malware is a software tool that scans and removes viruses, worms, trojans, spyware, ransomware, and other malicious software from a device. However, antivirus/anti- malware does not filter or block network traffic, and it may not be able to detect or prevent some web-based attacks, such as XSS or SQL injection. Antivirus/anti-malware is also often used in conjunction with a firewall, not as a replacement.
References:
CompTIA A+ Core 1 (220-1101) Certification Study Guide, Chapter 5: Networking, Section 5.4: Network Devices, Page 233 CompTIA A+ Core 1 (220-1101) and Core 2 (220-1102) Exam Cram, Chapter 5: Networking, Section 5.4:
Network Devices, Page 197
CompTIA A+ Core 1 (220-1101) and Core 2 (220-1102) Pearson uCertify Course and Labs and Textbook Bundle, Chapter 5: Networking, Section 5.4: Network Devices, Page 234 CompTIA A+ Core 1 (220-1101) and Core 2 (220-1102) Cert Guide, Chapter 5: Networking, Section 5.4:
Network Devices, Page 205
CompTIA A+ Core 1 (220-1101) Certification Study Guide, Chapter 9: Security, Section 9.3: Device Security, Page 419 CompTIA A+ Core 1 (220-1101) Certification Study Guide, Chapter 9: Security, Section 9.4: Network Security, Page 431 CompTIA A+ Core 1 (220-1101) Certification Study Guide, Chapter 9: Security, Section 9.5: Malware and Threats, Page 443
