1.9 Describe Defense in Depth Strategy Such as Secure Architecture for Everyone (SAFE) 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is implementing a SAFE-based architecture and needs to protect its internal web application from application-layer attacks such as SQL injection and cross-site scripting (XSS). The application is hosted in the company's data center. Which control should be placed in the data center to specifically address this requirement?

   • AImplement a stateful firewall between the web server and the application server.
   • BDeploy a network-based intrusion detection system (IDS) on the core switch.
   • CDeploy a web application firewall (WAF) in front of the web server.
   • DUse network access control (NAC) to authenticate users before they access the web application.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A hospital is designing a defense-in-depth strategy using SAFE. They have a campus network with multiple buildings, a data center, and a cloud presence for patient portals. A key constraint is that patient data must remain within the hospital's on-premises data center due to regulatory requirements. The network team wants to ensure that even if the perimeter firewall is compromised, the patient data remains protected. Which combination of controls best addresses this constraint and aligns with SAFE?

   • AUse a VPN for all internal traffic between the campus and data center, assuming the encryption will protect the data.
   • BMove the patient data to the cloud and rely on the cloud provider's default encryption.
   • CImplement micro-segmentation between the data center server tiers and deploy a host-based firewall on the database servers.
   • DDeploy a single, high-end next-generation firewall at the data center edge and disable all other controls to reduce complexity.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a defense-in-depth strategy, what is the primary purpose of implementing redundant security controls?

   • ATo increase the complexity of the network design
   • BTo eliminate the need for security policies and user training
   • CTo ensure that a single point of failure does not compromise the entire security posture
   • DTo reduce the need for security monitoring and incident response
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of the Cisco SAFE model?

   • ATo define a single best-practice configuration for all network devices
   • BTo replace the need for security policies and compliance frameworks
   • CTo provide a prescriptive set of security products that must be purchased from Cisco
   • DTo offer a holistic, architecture-based approach to designing and implementing network security
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes the core principle of defense in depth?

   • APlacing all security controls at the network edge to simplify management
   • BImplementing multiple layers of security controls so that if one fails, others still provide protection
   • CRelying on a single, strong security control at the network perimeter
   • DUsing only hardware-based security appliances to protect the network
   Reveal Solution Discussion Select an answer first