nerdexam
GIAC

GSLC · Question #306

Which firewall architecture uses two NICs with a screening router inserted between the host and the untrusted network?

The correct answer is C. Screened host. The screened host architecture places a screening router between the untrusted network and a bastion host that has two NICs. This creates a layered filtering boundary.

Security Architecture & Engineering

Question

Which firewall architecture uses two NICs with a screening router inserted between the host and the untrusted network?

Options

  • ADeep packet inspection
  • BPacket hosting
  • CScreened host
  • DPacket filtering

How the community answered

(33 responses)
  • A
    3% (1)
  • C
    91% (30)
  • D
    6% (2)

Why each option

The screened host architecture places a screening router between the untrusted network and a bastion host that has two NICs. This creates a layered filtering boundary.

ADeep packet inspection

Deep packet inspection is a traffic inspection technique, not a firewall architecture defined by the number of NICs or placement of a screening router.

BPacket hosting

Packet hosting is not a recognized standard firewall architecture in security frameworks.

CScreened hostCorrect

A screened host firewall architecture uses a screening router to filter traffic from the untrusted network before it reaches a dual-homed bastion host with two NICs. The router performs packet filtering as the first line of defense, and the bastion host enforces application-layer policies as the second layer. This design separates the untrusted external network from the internal trusted network using both router and host-based controls.

DPacket filtering

Packet filtering describes a method of traffic inspection performed by routers or firewalls, not a specific architectural topology involving dual NICs and a bastion host.

Concept tested: Screened host firewall architecture design

Source: https://csrc.nist.gov/publications/detail/sp/800-41/rev-1/final

Topics

#screened host firewall#firewall architecture#dual-homed host#perimeter security

Community Discussion

No community discussion yet for this question.

Full GSLC Practice