1.9 Describe Defense in Depth Strategy Such as Secure Architecture for Everyone (SAFE) 350-701 Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A managed security service provider (MSSP) is explaining the value of the SAFE model to a new client. The client's current security posture consists of a single next-generation firewall at the internet edge and no internal segmentation. The client wants to understand how SAFE can improve their security. Which statement best describes the core benefit of adopting the SAFE model?

   • AIt provides a prescriptive, vendor-agnostic blueprint for implementing defense in depth across the entire network architecture.
   • BIt guarantees the network will be immune to all cyberattacks if followed correctly.
   • CIt focuses primarily on deploying the most advanced security products from a single vendor.
   • DIt simplifies security by consolidating all controls into a single device at the network perimeter.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is looking to improve its security posture and is considering adopting the SAFE model. The company has a complex network with multiple branches, a data center, and cloud workloads. The security team is struggling to manage security policies across all these environments. Which aspect of the SAFE model directly addresses this challenge?

   • AIts recommendation to use a single vendor for all security products.
   • BIts focus on a holistic, architecture-based approach that simplifies and guides security design across the entire network.
   • CIts emphasis on using only cloud-based security solutions.
   • DIts requirement to deploy the same security controls at every location.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a pillar in the Cisco SAFE model?

   • ANetwork Access Control (NAC)
   • BInternet of Things (IoT)
   • CZero Trust
   • DData Center
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A retail company is expanding its network to include a new branch office. The branch will have local internet access and will connect back to the headquarters data center over a secure VPN. According to the SAFE model, which controls should be considered for the new branch office?

   • AA network access control (NAC) system only, to manage employee devices.
   • BOnly a VPN concentrator, since the branch is a remote site.
   • CA next-generation firewall (NGFW) with IPS and URL filtering at the branch internet edge.
   • DNo additional controls, since all traffic is backhauled to the data center for inspection.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A financial services firm is migrating a critical application to the cloud. The CISO mandates a defense-in-depth strategy that aligns with SAFE. The firm has a mature on-premises security stack and wants to extend the same level of control to the cloud. The cloud environment will have a mix of public-facing web servers and internal application servers. Which approach best extends the SAFE model to the cloud while maintaining a consistent security posture?

   • ADeploy a cloud-native web application firewall (WAF) in front of the public web servers and use network security groups (NSGs) to segment the internal application servers.
   • BExtend the on-premises firewall to the cloud by creating a site-to-site VPN and routing all cloud traffic back to the data center for inspection.
   • CRely on the cloud provider's default security features and do not implement any additional controls.
   • DDeploy a single, centralized next-generation firewall (NGFW) virtual appliance in the cloud and route all traffic through it.
   Reveal Solution Discussion Select an answer first