5.1 Network Security Design and Integration 400-007 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A financial services firm is redesigning its data center network to isolate cardholder data (CDE) from the rest of the corporate network. The design must prevent lateral movement from the corporate zone to the CDE zone while still allowing the CDE application servers to initiate outbound updates to a specific patch repository in the corporate zone. The security team insists on stateful inspection at every trust boundary. Which segmentation approach best meets these requirements?

   • ADeploy a stateful firewall between the corporate and CDE zones, with rules allowing only the CDE servers to initiate connections to the patch repository IP and denying all other CDE-to-corporate traffic.
   • BPlace the CDE servers in the same VLAN as the corporate servers and rely on host-based firewalls on each CDE server to block inbound connections from the corporate zone.
   • CConfigure a private VLAN on the access switches to isolate the CDE servers from the corporate zone, and allow the patch repository to reach the CDE servers through a routed interface.
   • DUse a router with static routes between the zones and implement ACLs that permit only the patch repository to initiate connections to the CDE servers.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which regulatory framework is specifically focused on protecting the privacy of personal data of individuals in the European Union?

   • AGDPR
   • BPCI DSS
   • CHIPAA
   • DSOX
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is a key security policy consideration when employees use external AI services that may process proprietary data?

   • ADefining what data can be shared with external AI services
   • BEnsuring that the AI service is free of charge
   • CEnsuring that the AI service is accessible from any network
   • DGuaranteeing that the AI service provides the most accurate results
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security architect has designed a new segmentation policy that uses a next-generation firewall to isolate the finance department from the rest of the network. Before rolling this out to production, the architect needs to validate that the firewall rules are working as intended and that no unintended traffic is being allowed. Which assurance method is most appropriate for this validation?

   • AReview the firewall configuration and compare it against the design documentation.
   • BRun a series of penetration tests from the finance network to the corporate network and from the corporate network to the finance network.
   • CDeploy the firewall in a lab environment and run a full production workload through it to observe the behavior.
   • DUse a network traffic generator to send benign traffic across the firewall and verify that the expected traffic is allowed and the unexpected traffic is blocked.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A marketing agency is using an external AI service to generate content for clients. The agency's security team is concerned about the AI service's use of client data, which may contain confidential business information. The agency's current security policy does not address AI services. The team must balance the need to use the AI service for productivity with the need to protect client data. Which approach best balances these competing requirements?

   • ADeploy a data loss prevention (DLP) solution that monitors and blocks the submission of client data to the AI service.
   • BAllow the use of the AI service but require that all client data be anonymized before being submitted.
   • CDevelop a policy that defines what types of client data can be submitted to the AI service and requires approval for any data that is not explicitly allowed.
   • DProhibit the use of all external AI services to eliminate the risk of data exposure.
   Reveal Solution Discussion Select an answer first