1.9 Describe Defense in Depth Strategy Such as Secure Architecture for Everyone (SAFE) 350-701 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A regional bank is redesigning its network security. The bank has a main headquarters campus, 40 branch offices connected over MPLS, and a growing set of workloads in a public cloud. The CISO wants a defense-in-depth strategy that follows the SAFE model, ensuring that security controls are placed consistently across all locations. The security team has limited staff and wants to avoid managing separate, inconsistent security policies at each site. Which approach best aligns with SAFE principles?

   • AUse a single next-generation firewall at the data center and rely on cloud provider default security for all other locations.
   • BPlace all security controls only at the internet edge of the headquarters campus, since all traffic can be backhauled over MPLS.
   • CDeploy identical firewall and IPS stacks at the campus, each branch, and the cloud edge, and manage them independently.
   • DImplement a centralized security management platform that pushes consistent policies to firewalls and IPS at the campus, branch, and cloud entry points.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's security policy requires that all remote workers connecting via VPN must have their devices checked for compliance before they are granted access to the internal network. The company also wants to ensure that if a compliant device later becomes infected, its access is limited. Which combination of controls implements this policy as a layered defense?

   • ARequire a strong password and multi-factor authentication (MFA) for the VPN, and consider the device secure.
   • BUse Network Access Control (NAC) to assess the device posture before VPN connection, and then place the device into a segmented VLAN after connection.
   • CDeploy an IPS at the VPN concentrator and assume it will block all traffic from infected devices.
   • DRely solely on the VPN's built-in encryption to protect the network from infected devices.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following best describes the holistic nature of the SAFE model?

   • AIt is designed to work only with Cisco products
   • BIt provides a one-size-fits-all security solution for every organization
   • CIt addresses security across the entire network, including people, processes, and technology
   • DIt focuses only on perimeter security controls
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In the SAFE architecture, which security control is most commonly associated with the 'Data Center' pillar?

   • AWeb filtering
   • BNetwork segmentation
   • CEmail security gateway
   • DVPN concentrator
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which security control is best mapped to the 'Branch' pillar in the SAFE architecture?

   • AIntrusion prevention system (IPS)
   • BNetwork access control (NAC) for guest devices
   • CData loss prevention (DLP) for cloud applications
   • DNext-generation firewall (NGFW) with URL filtering
   Reveal Solution Discussion Select an answer first