5.4 Describe the Components of Network Security Design 350-401 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A retail company is designing a defense-in-depth strategy for its payment card processing environment. The company wants to ensure that even if an attacker compromises a web server, they cannot easily reach the database server. Which design principle should be applied?

   • AUse MACsec to encrypt traffic between the web and database servers.
   • BInstall antivirus on all servers.
   • CDeploy an IDS in promiscuous mode on the database segment.
   • DSegment the network into zones and enforce strict firewall policies between the web and database tiers.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A law firm wants to protect its partners' laptops from malware and unauthorized access, but also needs to ensure that only approved applications can run on these devices. The firm wants a single solution that provides antivirus, host intrusion prevention, and application control. Which technology should be deployed?

   • AA next-generation endpoint protection platform (EPP) that includes antivirus, host intrusion prevention, and application control.
   • BA traditional antivirus product with a separate host firewall.
   • CA NAC solution that checks endpoint compliance before granting network access.
   • DA network-based intrusion prevention system (IPS) placed at the internet edge.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which technology is specifically designed to detect and block malware that uses unknown or zero-day exploits?

   • AAdvanced malware protection (AMP)
   • BSignature-based IDS
   • CStateful firewall
   • DNetwork access control (NAC)
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the role of the Cisco Identity Services Engine (ISE) in TrustSec architecture?

   • ATo provide routing between VLANs
   • BTo encrypt all network traffic
   • CTo act as the policy server that defines and distributes security group policies
   • DTo monitor network performance
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company wants to block peer-to-peer file sharing traffic on its network. The NGFW is configured with an application filter that blocks the 'BitTorrent' application. However, users are still able to download files using a browser-based torrent client that uses HTTPS. What is the most likely reason the filter is not working?

   • ASSL/TLS inspection is not enabled, so the NGFW cannot see the application inside the encrypted HTTPS stream.
   • BThe browser-based torrent client uses a different application signature than the standalone BitTorrent client.
   • CThe application filter is configured for the wrong direction.
   • DThe NGFW does not support application filtering for HTTPS traffic.
   Reveal Solution Discussion Select an answer first