2.8 Apply Segmentation to a Network 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security architect is designing a segmentation strategy for a multi-site organization. The organization has a central data center and several branch offices. The architect needs to ensure that a breach in one branch office does not spread to the data center or other branches. Which design principle is most important to achieve this?

   • ARely on the internet service provider's network to isolate traffic between sites.
   • BUse the same VLAN IDs across all sites to simplify configuration.
   • CImplement separate trust zones for each site and enforce strict firewall rules between them.
   • DUse a single VPN tunnel between all sites to simplify management.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After implementing VLAN segmentation between the finance and HR departments, the security team wants to verify that no unintended traffic crosses the boundary. They have access to the network devices and can generate test traffic. Which verification method provides the most direct evidence that the segmentation is working as intended?

   • AReview the ACL counters on the boundary interfaces to confirm that only permitted traffic has been forwarded.
   • BCheck the VLAN configuration on each switch to ensure the VLANs are assigned to the correct ports.
   • CUse a packet sniffer on the finance VLAN to capture all traffic and look for HR IP addresses.
   • DVerify that the HR VLAN has a different subnet and that routing is enabled between the VLANs.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services firm is designing a new data center. They need to isolate development, test, and production environments. The environments share the same physical switches and must be able to communicate with each other only through a central firewall. Which segmentation approach should they use?

   • APhysical segmentation with separate switches for each environment.
   • BA flat network with a single subnet and rely on application-level authentication.
   • CMicro-segmentation using host-based policies on each server.
   • DLogical segmentation using VLANs, with inter-VLAN routing performed by the firewall.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team has implemented segmentation between the engineering and finance departments. They want to continuously monitor that the segmentation is effective. Which monitoring approach is most appropriate?

   • AConducting a penetration test once a year to verify the segmentation.
   • BReviewing firewall logs on a weekly basis for any denied traffic between the departments.
   • CDeploying a network traffic analyzer that monitors flows between the two departments and compares them to the policy.
   • DConfiguring an alert that triggers when any traffic is denied between the two departments.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is implementing segmentation between its corporate LAN and a guest Wi-Fi network. The guest network should only have internet access and must not reach internal resources. The corporate LAN must be able to reach the internet and internal servers. Which enforcement method is the most appropriate?

   • APlace guest and corporate traffic in the same VLAN and rely on the guest Wi-Fi password for security.
   • BUse an ACL on the guest VLAN that denies all traffic, including internet access.
   • CConfigure the guest network with a private IP range and no default gateway.
   • DConfigure a firewall rule that allows guest traffic only to the internet and denies all traffic from guest to the corporate LAN.
   Reveal Solution Discussion Select an answer first