2.8 Apply Segmentation to a Network 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A university is redesigning its campus network. The administration wants to separate student dormitory traffic from faculty research traffic, but both groups need access to the internet and to a shared library database. The research lab also has sensitive grant data that should not be accessible from the dormitory network. Which grouping strategy best aligns with trust zones and data sensitivity?

   • ACreate separate VLANs for dormitory and research, with a firewall allowing both to reach the internet and the library database, but denying dormitory-to-research traffic.
   • BPlace all users in a single VLAN and rely on host-based firewalls on the research lab computers.
   • CPut the library database in the dormitory VLAN and the research data in the research VLAN, with no inter-VLAN routing.
   • DCreate separate VLANs but allow all traffic between them to simplify management.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A university campus network has a guest Wi-Fi SSID and a staff Wi-Fi SSID. The guest network must only access the internet, while staff need access to internal servers. Both SSIDs terminate on the same wireless controller. Which enforcement method should be used?

   • AUse the same VLAN for both SSIDs and rely on the staff's stronger passwords.
   • BConfigure the wireless controller to bridge guest traffic directly to the staff VLAN.
   • CDisable DHCP on the guest SSID so clients cannot obtain an IP address.
   • DPlace each SSID in a separate VLAN and apply an ACL on the VLAN interface that blocks guest traffic to internal subnets.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When designing network segments, which factor is most important for grouping assets?

   • AThe trust level and data sensitivity of the assets
   • BThe vendor of the hardware
   • CThe physical location of the devices
   • DThe age of the equipment
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A large enterprise is migrating its data center to a private cloud. The security team must isolate different business units (finance, HR, R&D) from each other. The cloud platform supports both VLANs and micro-segmentation via a distributed firewall. The compliance team requires that all traffic between business units be inspected by a central firewall for logging. The network team wants to minimize the number of firewall rules to manage. Which approach best balances these requirements?

   • AUse VLANs for each business unit and enforce policies with ACLs on the virtual switches.
   • BUse VLANs for each business unit and route all inter-VLAN traffic through a central firewall.
   • CUse a combination of VLANs for coarse separation and micro-segmentation for fine-grained control, with all inter-business-unit traffic routed through a central firewall.
   • DUse micro-segmentation with distributed firewall policies for each business unit and do not use a central firewall.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does network segmentation help contain a breach?

   • ABy isolating compromised segments so that attackers cannot easily move laterally to other parts of the network
   • BBy preventing all malicious traffic from entering the network
   • CBy automatically patching vulnerabilities in segmented devices
   • DBy encrypting all data within each segment
   Reveal Solution Discussion Select an answer first