1.9 Describe Defense in Depth Strategy Such as Secure Architecture for Everyone (SAFE) 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When implementing a defense-in-depth strategy using SAFE, what is the role of the 'Campus' pillar?

   • ATo protect the internal network infrastructure and users within a physical location
   • BTo provide security for remote workers connecting from home
   • CTo secure the connection between the organization and its cloud providers
   • DTo secure the data stored in on-premises data centers
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In the SAFE model, what is meant by 'places in the network'?

   • AThe virtual machines and containers that run applications
   • BThe geographic regions where an organization operates
   • CThe specific points in the network architecture where security controls are deployed
   • DThe physical locations where network devices are installed
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is designing a defense-in-depth strategy for its new headquarters. The security team has already deployed a perimeter firewall and an IPS. To further strengthen the security posture, they want to add a layer of control that focuses on the endpoint devices themselves. Which control is most appropriate for this purpose?

   • AConfigure the existing IPS to block all traffic from unknown IP addresses.
   • BUse a network-based antivirus solution that scans traffic at the perimeter.
   • CDeploy an endpoint detection and response (EDR) solution on all workstations and servers.
   • DImplement a second perimeter firewall in parallel with the existing one for redundancy.
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A security architect is presenting a new security strategy to the board of directors. The architect recommends adopting the SAFE model. A board member asks, 'How is this different from just buying more security products?' Which response best explains the value of the SAFE model?

   • ASAFE focuses only on the network perimeter, so it is simpler than other approaches.
   • BSAFE provides a structured framework that guides where and how to deploy security controls, ensuring they work together as a cohesive system.
   • CSAFE is a specific product suite that includes all necessary security tools in one package.
   • DSAFE guarantees that the company will pass all compliance audits.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A university is implementing a defense-in-depth strategy for its research network, which contains sensitive intellectual property. The network is segmented into multiple VLANs. The security team has deployed an internal firewall between VLANs and an IPS at the internet edge. During a review, they realize that a compromised workstation on a low-trust VLAN could still directly access a high-value research server on another VLAN. Which additional control would most directly address this gap in the layered defense?

   • AIncrease the IPS signature update frequency at the internet edge.
   • BImplement a VPN for all remote access to the research network.
   • CAdd a second internal firewall in parallel with the existing one for redundancy.
   • DDeploy a host-based firewall on the research servers to restrict inbound traffic to only required ports and source IPs.
   Reveal Solution Discussion Select an answer first