3.7 Security Features to Comply with Organizational Security Policies, Procedures, and Standards BCP 38 CCIE-SECURITY Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A government agency is implementing ISO 27001 and needs to ensure that its network infrastructure supports the ISMS. The agency has multiple departments with different security requirements. Which approach best aligns the network infrastructure with ISO 27001 requirements?

   • AUse the same security controls for all departments regardless of their risk profile
   • BFocus solely on technical controls and ignore administrative and physical controls
   • CDefine a network security policy that includes risk-based segmentation and access controls, and enforce it through firewall and VLAN configurations
   • DImplement controls only after a security incident occurs
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A university is implementing BCP 38 ingress filtering on its border routers to prevent students from spoofing IP addresses. The university has multiple public IP ranges assigned to different departments. Which ACL design best implements ingress filtering while minimizing operational impact?

   • ACreate an ACL that permits only the most commonly used department's IP range and denies all others
   • BCreate an ACL that permits all of the university's assigned public IP ranges and denies all other source addresses, applied inbound on the internet-facing interface
   • CApply the ACL outbound on the internet-facing interface to filter incoming traffic
   • DUse a single ACL that permits all RFC 1918 private addresses and denies public addresses
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A small e-commerce business is working toward PCI-DSS compliance. The business uses a single server for both the web application and the database that stores cardholder data. The assessor recommends segmentation to reduce scope. Which action is most effective in reducing PCI-DSS scope?

   • ADisable the database's network access entirely and only allow local access
   • BKeep the web and database on the same server but encrypt the database files
   • CMove the database to a separate server and place a firewall between the web server and the database, restricting access to only necessary ports
   • DUse a virtual LAN (VLAN) to separate the web and database functions on the same physical server
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A cloud service provider is implementing BCP 38 egress filtering on its virtual network edge to prevent customers from sending spoofed traffic. The provider assigns each customer a unique public IP range. Which egress filtering policy should be applied to each customer's virtual router?

   • ADeny only the customer's assigned IP range on the outbound interface
   • BPermit only the customer's assigned public IP range as the source address on the outbound interface
   • CApply an inbound ACL on the customer's interface that permits only the assigned range
   • DPermit all source addresses on the outbound interface to allow flexibility for customer applications
   Reveal Solution Discussion Select an answer first