2.8 Apply Segmentation to a Network 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A manufacturing company wants to segment its industrial control system (ICS) network from the corporate IT network. The ICS network contains programmable logic controllers (PLCs) that must be reachable by a specific engineering workstation for maintenance. The company wants to minimize the risk of a corporate network compromise affecting the ICS. Which design best meets these requirements?

   • APlace the ICS network in a separate VLAN with a firewall that allows only the engineering workstation to reach the PLCs on the required maintenance ports.
   • BUse a VPN for the engineering workstation to reach the PLCs over the internet, bypassing the corporate network.
   • CConnect the ICS network directly to the corporate core switch with no firewall.
   • DPlace the ICS and corporate networks in the same VLAN but use host-based firewalls on the PLCs.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A hospital is implementing segmentation to protect patient data. They have three zones: clinical devices (infusion pumps), clinical workstations, and the electronic health record (EHR) server. The clinical devices must only communicate with the EHR server, and the clinical workstations must communicate with both the EHR server and the clinical devices for management. The network team wants to minimize the attack surface while maintaining operational functionality. Which segmentation design best meets these requirements?

   • APlace all devices in a single VLAN and rely on application-level authentication.
   • BCreate two VLANs: one for clinical devices and workstations, and one for the EHR server.
   • CUse micro-segmentation on each device, but do not use VLANs.
   • DCreate three VLANs: one for clinical devices, one for clinical workstations, and one for the EHR server, with firewall rules that permit only the required flows.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of grouping assets by user role for segmentation?

   • AConnecting all printers to the same switch
   • BPlacing all servers in one VLAN regardless of function
   • CPutting HR systems and payroll data in a separate segment from general corporate users
   • DUsing a single flat network for all employees
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is explaining to management why the network should be segmented. The analyst needs to emphasize the primary security benefit of segmentation. Which statement best describes that benefit?

   • ASegmentation limits the blast radius of a security incident by containing lateral movement.
   • BSegmentation simplifies IP address management by using smaller subnets.
   • CSegmentation eliminates the need for endpoint security software.
   • DSegmentation increases network performance by reducing broadcast domains.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company is deploying a new point-of-sale (POS) system. The POS terminals must communicate with the payment processing server, but they should not be able to reach the corporate file servers. The network team wants to use a simple, cost-effective method that does not require new hardware. Which approach should they use?

   • APlace POS terminals and file servers in the same VLAN and use host-based firewalls on the file servers.
   • BCreate a separate VLAN for POS terminals and configure an ACL that permits only traffic to the payment server subnet.
   • CInstall a new physical firewall between the POS terminals and the rest of the network.
   • DUse a VPN tunnel from each POS terminal to the payment server.
   Reveal Solution Discussion Select an answer first