Firewalls

Correct Answer: Apply an inbound access rule for FTP traffic

The best action for a network administrator to take to prevent unauthorized users from connecting to the company's FTP server is to 'Apply an inbound access rule for FTP traffic'. This rule only allows specific, approved users or IP addresses to connect to the FTP server, effectively stopping unauthorized access. 'Disable all FTP services' might secure the server, but it would also prevent authorized users from accessing it, rendering the server useless. 'Restrict access with NAT rules' is not specific to FTP and could inadvertently block legitimate traffic. 'Enable DHCP snooping' is related to monitoring the network for rogue DHCP servers and has little to do with securing an FTP server against unauthorized access.

Correct Answer: Heuristic analysis

Heuristic analysis is the best answer for protecting against zero-day attacks by analyzing and blocking suspicious behavior patterns.

Heuristic analysis uses behavioral patterns and rules to identify potentially malicious activities, even if the specific threat is not yet known. This makes it particularly effective against zero-day attacks, which exploit previously unknown vulnerabilities.

Stateful packet inspection primarily focuses on tracking the state of network connections and doesn't typically analyze behavior patterns for unknown threats.

Deep packet inspection examines the contents of data packets but doesn't necessarily identify new or unknown threat patterns.

Application layer filtering controls traffic based on specific applications or protocols but doesn't inherently analyze behavior patterns for zero-day threats.

Heuristic analysis stands out as the most suitable option for detecting and preventing zero-day attacks by identifying suspicious behavior patterns in real-time.

Correct Answer: Port forwarding

The correct answer is 'Port forwarding'. This is because if a network administrator needs to permit an internal web server to be accessible externally, they will typically use port forwarding. This is a method of making a computer on a private network reachable from the outside, through a gateway device such as a router. It involves forwarding requests for a specific port to an internal IP address. 'Stateful packet inspection' is not the correct answer because it's a firewall feature used for the tracking of network connections to determine the state of a connection/session and make decisions based on connection state information. 'Outbound access rule' is also not correct because it involves controlling traffic originating from the network going towards the internet. The 'Inbound access rule' could be used to allow access to the server, but it is generally less secure and precise compared to port forwarding.