A company is implementing a defense-in-depth strategy. They have a web server that is accessible from the internet. The security team has deployed a firewall at the internet edge. To add a layer of protection specifically for the web server, which control should be placed directly in front of the web server?

A virtual private network (VPN) concentrator

A network-based intrusion detection system (IDS)

A web application firewall (WAF)

A large enterprise is redesigning its network security using the SAFE model. The enterprise has a campus network, a data center, and a WAN connecting multiple branches. A key requirement is to ensure that a malware infection in one branch cannot easily spread to other branches or the data center. The security team is evaluating different segmentation strategies. Which approach provides the most effective defense in depth against this lateral spread?

Implement micro-segmentation within the data center and use a next-generation firewall (NGFW) with intrusion prevention at the WAN edge of each branch.

Deploy an intrusion detection system (IDS) at the data center and the campus, but not at the branches.

Rely on the WAN provider's encryption to prevent the spread of malware between branches.

Use a single, centralized firewall at the data center and route all inter-branch traffic through it for inspection.

A multinational company is adopting the SAFE model. They have a large campus network, a software-defined WAN (SD-WAN) connecting branches, and a significant presence in a public cloud. The security architect needs to ensure that the SAFE 'places in the network' are correctly identified to place appropriate controls. Which set of locations correctly represents the distinct SAFE places in this environment?

Core, Distribution, Access, Edge, and Management

LAN, WLAN, WAN, VPN, and Internet

Headquarters, Remote Office, Home Office, Colocation, and Public Cloud

Campus, Branch, Data Center, WAN, and Cloud

What is the first step in applying the SAFE methodology to design a defense-in-depth strategy?

Understanding the business requirements and security objectives

Deploying firewalls at all network boundaries

Creating a network diagram of the existing infrastructure

Selecting specific security products from a vendor catalog

CiscoCertified Network Professional Security

Domain 1Objective 9

1.9 Describe Defense in Depth Strategy Such as Secure Architecture for Everyone (SAFE) 350-701 Practice Questions (Page 5)

Part of the Security Concepts domain, which accounts for 20% of the 350-701 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

5concepts

20%of the exam

Questions 21–25

21application · medium
A company is implementing a defense-in-depth strategy. They have a web server that is accessible from the internet. The security team has deployed a firewall at the internet edge. To add a layer of protection specifically for the web server, which control should be placed directly in front of the web server?
Select an answer first
22expert · hard
A large enterprise is redesigning its network security using the SAFE model. The enterprise has a campus network, a data center, and a WAN connecting multiple branches. A key requirement is to ensure that a malware infection in one branch cannot easily spread to other branches or the data center. The security team is evaluating different segmentation strategies. Which approach provides the most effective defense in depth against this lateral spread?
Select an answer first
23application · easy
A multinational company is adopting the SAFE model. They have a large campus network, a software-defined WAN (SD-WAN) connecting branches, and a significant presence in a public cloud. The security architect needs to ensure that the SAFE 'places in the network' are correctly identified to place appropriate controls. Which set of locations correctly represents the distinct SAFE places in this environment?
Select an answer first
24application · easy
A company is adopting the SAFE model and is identifying the 'places in the network' for a new office. The office has a local network, a connection to the internet, and a VPN back to the corporate data center. According to SAFE, which 'place in the network' does this office represent?
Select an answer first
25foundation · easy
What is the first step in applying the SAFE methodology to design a defense-in-depth strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-701” is a trademark of its owner, used for identification only.

1.9 Describe Defense in Depth Strategy Such as Secure Architecture for Everyone (SAFE) 350-701 Practice Questions (Page 5)

Questions 21–25

A company is adopting the SAFE model and is identifying the 'places in the network' for a new office. The office has a local network, a connection to the internet, and a VPN back to the corporate data center. According to SAFE, which 'place in the network' does this office represent?

What is the first step in applying the SAFE methodology to design a defense-in-depth strategy?

Keep studying — Security Concepts