Apprentice Exam Questions Tutorials

Restricting access to phishing websites is an effective URL filtering use case. URL filtering evaluates web destinations by category, reputation, risk, or policy and can block users from visiting malicious or prohibited sites. Phishing sites are designed to steal credentials or sensitive information, so blocking known or suspected phishing URLs reduces the chance that users will submit passwords or tokens to attacker-controlled pages. Monitoring threat logs and traffic logs is a security operations activity, not the direct purpose of URL filtering. Sandboxing potentially malicious files is a malware analysis function. Discovering IoT devices is asset visibility or IoT security, not URL filtering. URL filtering is especially valuable when combined with user awareness, DNS security, browser protection, and identity-based policy. Because phishing often starts with a link, controlling access to risky web destinations is a practical prevention layer. Reference/topics: Network Security 3.3, URL filtering; Cybersecurity 1.3, social engineering and phishing.

Zero Trust is a strategic security approach based on continuous validation rather than implicit trust. Instead of assuming that users, devices, applications, or workloads are trustworthy because they are inside a network boundary, Zero Trust requires verification throughout the digital interaction. This includes validating identity, device posture, application access, least privilege, segmentation, and ongoing behavior. Incident response plans are important after suspicious activity or incidents occur, but they are not the continuous trust validation model. Compliance planning maps controls to regulatory or framework requirements, but compliance alone does not guarantee continuous security verification. Operations playbooks guide repeatable SOC actions, but they are procedural tools rather than the strategic architecture described in the question. Zero Trust adoption changes how access decisions are made: trust is earned, scoped, and re-evaluated, not permanently granted. Reference/topics: Cybersecurity 1.6, Zero Trust; Identity Security 7.1 and 7.2, IAM, MFA, RBAC, least privilege.

East-west traffic is internal traffic moving between systems within the same environment or data center. Packets moving between virtual servers across a virtual switch are east-west because they remain inside the data center or virtualized environment. This traffic may never pass through a traditional perimeter firewall unless the architecture specifically routes it through inspection points. Internet-originated traffic to a public IP address is north-south because it enters the environment from outside. Traffic from a virtual desktop to a cloud-based proxy leaves toward an external or cloud service, making it north-south or external service traffic. Traffic from a cloud-based server to a virtual desktop crosses environment boundaries and is not the clearest east-west example. East-west visibility is critical because attackers who compromise one workload often attempt lateral movement to other internal systems. Segmentation, internal firewalls, workload security, and telemetry help control this risk. Reference/topics: Network Fundamentals 2.2, east-west and north-south traffic; Cloud Security 5.4, virtualization.

A proxy server acts as an intermediary between a client and an online resource. Instead of the user system connecting directly to the destination server, the request is sent to the proxy, which forwards, filters, logs, or inspects the traffic according to policy. This design allows organizations to control web access, enforce acceptable use policies, inspect content, apply authentication, and hide some internal network details from external destinations. A proxy does not increase the processing power of the user’s device. It is not limited to email, although mail security gateways can perform similar intermediary functions for email traffic. It also does not directly connect endpoint agents to web servers as its core function. In security architecture, proxies are useful control points because they sit in the request path and can make decisions before a user reaches a site or downloads content. Reference/topics: Network Security 3.3, proxies and URL filtering; Network Security 3.6, enterprise browsers.