TRUE or FALSE. A Virtual System in Bridge Mode can enforce anti-spoofing definitions.

Question

Options

• AFalse, anti-spoofing can't be configured for Virtual systems in Bridge Mode
• BTrue, as long as the Virtual System has more than two interfaces defined
• CTrue, anti-spoofing must be manually defined in bridge mode
• DTrue, as long as Network Address Translation is performed
• ETrue, anti-spoofing measures are defined automatically is Bridge mode

• A
  11% (4)
• B
  3% (1)
• C
  77% (27)
• D
  6% (2)
• E
  3% (1)

Explanation

Option C is correct because Virtual Systems operating in Bridge Mode do support anti-spoofing enforcement, but unlike routed mode - where anti-spoofing definitions can be automatically derived from the routing table - bridge mode has no routing table to reference. This means the administrator must manually define which source IP addresses are valid on each interface.

Why the distractors are wrong:

• A is wrong because it claims anti-spoofing can't be configured at all in bridge mode - it can, just manually.
• B is wrong because the number of interfaces is irrelevant; manual configuration is required regardless of interface count.
• D is wrong because NAT has no bearing on anti-spoofing enforcement - they are independent features.
• E is the most dangerous distractor: it flips the key detail. Automatic anti-spoofing works in routed mode (via the routing table), not bridge mode.

Memory tip: Think "Bridge = Manual Bridge Toll." In routed mode, the firewall automatically "reads the map" (routing table) to know what's valid. In bridge mode, there's no map - you must manually hand it the directions. If you see "automatic" paired with "bridge mode" on an exam, treat it as a red flag.

No community discussion yet for this question.