5.1 Network Security Design and Integration 400-007 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which approach is a common method for implementing network segmentation in a data center environment?

   • ARelying solely on host-based firewalls on each server
   • BDeploying a single flat Layer 2 network for all servers
   • CUsing micro-segmentation policies based on application workloads
   • DPlacing all servers in the same broadcast domain
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of a security control validation (SCV) process in network design?

   • ATo design new security controls from scratch
   • BTo create security policies for the organization
   • CTo ensure that security controls are implemented and operating correctly
   • DTo replace manual security processes with automated tools
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which activity is an example of a security assurance method used to validate that a firewall is functioning as intended?

   • AUpdating the firewall's firmware to the latest version
   • BChecking the firewall's power supply redundancy
   • CReviewing the firewall's hardware specifications
   • DPerforming a penetration test against the firewall's rule set
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is implementing a bring-your-own-device (BYOD) policy. The security team wants to ensure that personal devices can access the internet but cannot access the corporate network. The company also wants to enforce a policy that blocks access to known malicious websites. Which policy enforcement point is best suited for this requirement?

   • AA firewall on the corporate network that blocks traffic from the BYOD VLAN to the corporate VLAN.
   • BA cloud-based web security gateway that filters internet traffic for all devices, including BYOD.
   • CA VPN concentrator that requires all BYOD devices to connect through VPN before accessing the internet.
   • DA NAC solution that authenticates BYOD devices and places them in a separate VLAN, combined with a web security gateway for internet filtering.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is implementing a NAC solution to control access to its network. The company has a mix of managed corporate devices and unmanaged personal devices. The security team wants to enforce a policy that allows managed devices to access the full network, but only allows unmanaged devices to access the internet. The company also wants to ensure that managed devices are compliant with security policies before granting access. Which NAC design best meets these requirements?

   • AUse a single NAC policy that requires all devices to authenticate and pass a posture check before granting access to the full network.
   • BUse a single NAC policy that grants all devices internet-only access, and rely on a separate firewall to control access to the full network.
   • CUse two NAC policies: one for managed devices that requires authentication and posture check, and one for unmanaged devices that only requires authentication and grants internet-only access.
   • DUse a single NAC policy that grants all devices full network access, and rely on the devices' own security software to enforce compliance.
   Reveal Solution Discussion Select an answer first