5.1 Network Security Design and Integration 400-007 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   A network designer is creating a segmentation strategy for a corporate campus. Which principle is the primary driver for determining the boundaries between different network segments?

   • AThe organizational chart of the company
   • BThe trust level and sensitivity of the data and assets within each zone
   • CThe physical location of the networking equipment
   • DThe number of VLANs that can be supported by the switches
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which component of Network Access Control is responsible for enforcing access decisions by allowing or blocking traffic at the network edge?

   • AThe authentication database
   • BThe posture agent
   • CThe policy server
   • DThe enforcement point
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A design team is choosing between two security architectures for a new e-commerce platform. Architecture A uses a single, highly available firewall cluster for all traffic. Architecture B uses multiple smaller firewalls distributed across the network segments. The primary concern is ensuring the platform remains available during a DDoS attack. Which architecture is more resilient to a DDoS attack, and why?

   • AArchitecture A, because a single cluster can be placed behind a DDoS mitigation service that scrubs the traffic.
   • BArchitecture B, because it is cheaper to deploy and maintain, leaving more budget for DDoS protection.
   • CArchitecture A, because a single cluster is easier to manage and can be scaled up to handle more traffic.
   • DArchitecture B, because the distributed firewalls can absorb the attack traffic across multiple devices, reducing the impact on any single device.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A healthcare provider is designing a network to support a new patient portal that will handle protected health information (PHI). The design must comply with HIPAA, which requires that PHI be protected and that access be logged and monitored. The provider also wants to segment the patient portal from the internal network. Which design decision is most directly driven by the HIPAA compliance requirement?

   • APlacing the patient portal servers in a DMZ segment separate from the internal network.
   • BEnabling detailed logging of all access to the patient portal and integrating these logs with a SIEM for monitoring and alerting.
   • CImplementing a firewall rule that allows only HTTPS traffic to the patient portal.
   • DUsing a load balancer to distribute traffic across multiple patient portal servers for high availability.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of posture assessment in a Network Access Control (NAC) solution?

   • ATo verify that devices meet security requirements before granting access
   • BTo assign IP addresses to devices on the network
   • CTo monitor network traffic for malicious activity
   • DTo provide encryption for all network traffic
   Reveal Solution Discussion Select an answer first