3.8 Cisco SAFE Model to Validate Network Security Design and to Identify Threats to Different PINs CCIE-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A company is designing a new data center and wants to align with the SAFE model. The architect must choose security capabilities that address the data center's unique threats. Which capability is most important for the data center PIN?

   • AAdvanced endpoint protection for servers.
   • BNetwork segmentation to isolate different application tiers.
   • CDDoS mitigation to ensure availability.
   • DData loss prevention (DLP) to prevent data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A security architect is validating a network design that includes a branch with a firewall and a data center with an IPS. The campus has no security controls. The architect must recommend the most critical improvement. Which improvement should be made?

   • AAdd encryption to the WAN links.
   • BAdd segmentation and endpoint protection to the campus.
   • CAdd DDoS protection to the data center.
   • DAdd a second firewall to the branch.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security architect is validating an existing network design using the Cisco SAFE model. The design has a flat network with no segmentation between the campus and data center, and all management interfaces are accessible from the user VLAN. Which SAFE design principle is most clearly violated?

   • AResilience
   • BSegmentation
   • CVisibility
   • DSecure management
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial services firm is designing a new data center PIN. The architect must ensure that the design addresses the most critical threats to this PIN. Which two threats should be prioritized, and what security capability is most effective against them?

   • APhysical theft and vandalism; install CCTV and biometric locks.
   • BDDoS and malware; deploy an on-premises firewall.
   • CEavesdropping and man-in-the-middle attacks; use encryption everywhere.
   • DInsider threats and data exfiltration; implement strict access controls and DLP.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is implementing a SAFE-based design for its campus network. The architect needs to choose security capabilities that align with the campus PIN's characteristics. Which combination of capabilities is most appropriate for the campus PIN?

   • ANetwork segmentation, endpoint protection, and visibility tools.
   • BDDoS mitigation and cloud access security broker (CASB).
   • CPhysical security controls and hardware security modules (HSMs).
   • DData loss prevention (DLP) and database activity monitoring.
   Reveal Solution Discussion Select an answer first