5.4 Describe the Components of Network Security Design 350-401 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An organization wants to block employees from using a specific social media application over the corporate network, even when the traffic is encrypted. The NGFW is deployed at the internet edge. Which NGFW feature must be configured to achieve this?

   • AURL filtering based on domain category
   • BUser identity-based policy with Active Directory integration
   • CPort-based ACL blocking common ports
   • DApplication filtering with SSL/TLS inspection
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A data center operator wants to encrypt all traffic between top-of-rack (ToR) switches and spine switches. The operator also wants to ensure that only authorized switches can join the encrypted links. The current environment uses a RADIUS server for network access. Which combination of technologies should be used?

   • AMACsec with static pre-shared keys
   • BMACsec with 802.1X authentication using RADIUS and MKA
   • C802.1X with VLAN assignment only
   • DIPsec with certificates on all switches
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the purpose of a security group tag (SGT) in Cisco TrustSec?

   • ATo encrypt all traffic between switches
   • BTo provide a unique IP address for each device
   • CTo classify traffic based on the security group of the source device
   • DTo replace the need for access control lists
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A multinational company is deploying NGFWs at its internet edge. The security team wants to ensure high availability and stateful failover. They also need to perform SSL/TLS inspection on all traffic. Which deployment model should they use?

   • ATwo NGFWs in active/active mode without synchronization of sessions.
   • BA single NGFW with redundant power supplies and links.
   • CTwo NGFWs in active/standby mode but with different SSL/TLS inspection policies.
   • DTwo NGFWs in an active/standby HA pair with a virtual IP, and configure SSL/TLS inspection on both devices.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A large enterprise is redesigning its security architecture. The network carries sensitive data that must be protected from lateral movement. The security team has a limited budget and must choose between deploying NGFWs at the internet edge and internal segmentation, or deploying Cisco TrustSec across the campus. The team also needs to detect and block zero-day malware that may enter through email. Which design best balances defense-in-depth and cost?

   • ADeploy TrustSec across the campus and rely on host firewalls for endpoint protection
   • BDeploy a single NGFW at the internet edge and use network IPS only
   • CDeploy NGFWs at the internet edge and between internal zones, and use endpoint security with EDR to detect zero-day malware
   • DDeploy TrustSec and NGFWs at every internal segment boundary
   Reveal Solution Discussion Select an answer first