Enterprise Virtual Network Security CND Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is designing a virtual network for a PCI-DSS compliant environment. The cardholder data environment (CDE) must be isolated from the rest of the network, but the application server in the CDE must communicate with a patch management server outside the CDE. The defender must balance compliance requirements with operational needs. Which design best satisfies both?

   • ADisable all communication between the CDE and the rest of the network.
   • BUse a VPN tunnel between the CDE and patch management server.
   • CPlace the CDE and patch management server in the same segment to simplify communication.
   • DPlace the CDE in its own virtual network segment, and allow only the specific patch management server IP and port to communicate with the CDE through a firewall rule.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A network defender is implementing security controls for a virtual network that hosts a multi-tenant SaaS application. Each tenant must be isolated from the others, but the application requires a shared database for common configuration data. The defender must ensure that tenants cannot access each other's data. Which control is most effective?

   • AUse virtual network segmentation to isolate each tenant's application tier, and enforce application-level access controls on the shared database.
   • BUse a single firewall rule to allow all traffic between tenants.
   • CPlace all tenants in the same virtual network and rely on the database's built-in encryption.
   • DGive each tenant its own physical server.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network defender notices that a virtual machine on a shared hypervisor is sending ARP replies claiming to be the default gateway. Other VMs on the same virtual switch are now routing traffic to this rogue VM. Which type of virtual network threat is this?

   • AARP spoofing
   • BVLAN hopping
   • CMAC flooding
   • DVM escape
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a virtual network with multiple VMs. The security team wants to detect anomalous behavior such as a VM communicating with an unusual external IP at odd hours. Which monitoring technique would be MOST effective?

   • AEnable NetFlow on the virtual switch and use a flow analysis tool to establish baselines and alert on anomalies
   • BMonitor the hypervisor's CPU usage
   • CUse a physical network tap on the internet link
   • DReview the VM's event logs only
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst notices that a VM is generating a large amount of broadcast traffic, causing performance degradation on the virtual switch. Which virtual network threat is this?

   • AVLAN hopping
   • BARP spoofing
   • CBroadcast storm
   • DMAC cloning
   Reveal Solution Discussion Select an answer first