5.4 Describe the Components of Network Security Design 350-401 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A regional bank is deploying a new internet edge for its headquarters. The security team requires that all inbound and outbound traffic be inspected for application-layer threats, and that users be identified by their Active Directory credentials rather than just IP address. The bank also wants to enforce different policies for guest and employee traffic without adding separate physical devices. Which deployment approach best meets these requirements?

   • ADeploy an IPS in passive tap mode and rely on the existing router ACLs for segmentation between guest and employee networks.
   • BDeploy a traditional stateful firewall with IP-based ACLs and enable NetFlow to identify users by correlating IP addresses with AD logs.
   • CDeploy a next-generation firewall in inline mode with user identity integration and application visibility, using virtual contexts or interfaces to separate guest and employee zones.
   • DDeploy a VPN concentrator with client certificates and route all traffic through it for inspection.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   How does an NGFW enforce application filtering policies?

   • ABy identifying the application and applying rules based on application identity
   • BBy blocking all traffic on well-known ports
   • CBy inspecting only the packet header
   • DBy using only IP address-based rules
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A hospital's IT department wants to protect its Windows-based workstations from ransomware. They have deployed an endpoint detection and response (EDR) solution. What additional capability should they enable to proactively prevent ransomware from executing?

   • AA network-based IPS that blocks known ransomware command-and-control traffic.
   • BRegular backups of all workstations.
   • CApplication control that only allows approved executables to run.
   • DA host firewall that blocks inbound connections.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What key exchange method is commonly used to establish MACsec keys?

   • ASSH key exchange
   • BSSL/TLS handshake
   • CIPsec IKEv2
   • D802.1X with EAP-TLS
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the primary role of endpoint security in a network security design?

   • ATo encrypt all data in transit across the network
   • BTo provide a backup solution for user data
   • CTo secure the network infrastructure devices such as routers and switches
   • DTo protect individual hosts from malware and unauthorized access
   Reveal Solution Discussion Select an answer first