3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16expert · medium

   A company is implementing a SAFE-based design with limited budget. They need to protect the campus, branch, and data center PINs. The campus has many users, the branch has a small number of users, and the data center hosts critical applications. Which capability should be prioritized to get the best security ROI?

   • ADDoS mitigation for the data center.
   • BAdvanced endpoint protection for the campus and branch.
   • CA next-generation firewall for the branch only.
   • DData loss prevention (DLP) for the data center.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium · select all that apply

   A security architect is assessing the threat landscape for a multi-PIN network. The network includes a campus, a branch, a data center, and a cloud environment. Which threats are most relevant to the cloud PIN? (Select all that apply.)

   • AAPI abuse and insecure interfaces
   • BPhysical theft of servers
   • CData exfiltration through cloud storage
   • DMisconfiguration of cloud resources
   Check answers Discussion Select an answer first
4. 18expert · medium

   A company has a network design that includes a data center with strong security controls, but the campus network has no segmentation and the branch has no security controls at all. The architect is using the SAFE model to validate the design. Which statement best describes the design's alignment with SAFE?

   • AThe design is misaligned because the branch should have more security than the data center.
   • BThe design is fully aligned because the data center is the most important PIN.
   • CThe design is partially aligned because the data center is protected, but the campus and branch are not.
   • DThe design is aligned because the campus and branch are low-risk PINs.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A network architect is designing a new branch office that will connect to the corporate data center via the internet. The architect wants to apply SAFE design principles. Which combination of principles and capabilities is most appropriate for this branch?

   • ASegmentation with VLANs, and visibility with NetFlow.
   • BResilience with a backup generator, and segmentation with a DMZ.
   • CResilience with redundant internet links, and secure management with VPN for remote access.
   • DSecure management with SNMPv3, and visibility with syslog.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security team is analyzing threats for a new cloud deployment. They are using the SAFE model to identify the most critical threats. Which threat should be considered the highest risk for the cloud PIN, and why?

   • ADDoS attacks, because they can take down the cloud service.
   • BInsider threats from cloud provider employees, because they have access to data.
   • CPhysical theft of cloud servers, because they contain sensitive data.
   • DMisconfiguration of cloud resources, because it can lead to data exposure and is common.
   Reveal Solution Discussion Select an answer first