2.8 Apply Segmentation to a Network 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A hospital network has a flat Layer 2 topology. The security team wants to isolate medical imaging devices (MRI, CT scanners) from general user workstations while keeping the imaging devices able to communicate with the PACS server. The imaging devices do not support 802.1X or host-based firewalls. Which segmentation approach best meets these requirements with the least operational overhead?

   • AConnect imaging devices to a separate physical switch and do not connect it to the rest of the network.
   • BDeploy micro-segmentation agents on each imaging device to enforce per-host policies.
   • CPlace imaging devices and the PACS server in a dedicated VLAN with ACLs restricting traffic to only the PACS server and management hosts.
   • DPlace imaging devices in the same VLAN as user workstations but apply a host-based firewall on the PACS server.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is planning to segment its network to reduce the impact of a potential ransomware infection. The primary goal is to contain the spread of malware from an infected workstation to other parts of the network. Which segmentation principle is most directly applied?

   • ADeploying a web application firewall (WAF) in front of internal applications.
   • BImplementing network address translation (NAT) for all internal hosts.
   • CGrouping assets into trust zones based on their sensitivity and communication needs.
   • DCreating a demilitarized zone (DMZ) for public-facing servers.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A manufacturing company has a network with three types of assets: corporate IT systems, industrial control systems (ICS), and guest Wi-Fi. They need to segment these assets to protect the ICS from potential attacks originating from the corporate network and guests. Which grouping strategy should they use?

   • AUse a single VLAN for all devices and rely on application-layer authentication.
   • BPlace ICS and corporate in the same zone, and guest in a separate zone.
   • CPlace all assets in a single trust zone and use strong passwords.
   • DCreate three separate trust zones: corporate, ICS, and guest, with strict firewall rules between them.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A data center hosts multiple tenants on shared physical servers. The security team wants to prevent a compromised virtual machine (VM) in one tenant from communicating with VMs in another tenant, even if they are on the same physical host. Which segmentation approach is most effective for this requirement?

   • APlace all tenants in the same VLAN and rely on the hypervisor's built-in firewall.
   • BApply ACLs on the physical switch ports connecting to the hosts.
   • CUse separate physical switches for each tenant.
   • DImplement micro-segmentation using virtual network policies that restrict traffic between VMs based on tenant and application tags.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After deploying a new segmentation policy that restricts the HR department from accessing the R&D file server, the security team wants to confirm that the policy is effective in production. They have access to a test account in HR and a test file on the R&D server. Which verification step provides the most reliable evidence?

   • ACheck the HR and R&D VLAN assignments on the switches to ensure they are different.
   • BReview the firewall rule configuration to ensure the deny rule is present and correctly ordered.
   • CRun a network scan from the HR subnet to see if the R&D file server responds.
   • DAttempt to access the R&D file server from an HR workstation using the test account and confirm that the access is denied.
   Reveal Solution Discussion Select an answer first