Enterprise Virtual Network Security CND Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A network defender needs to capture and analyze traffic between two VMs in a virtual network to troubleshoot a suspected security issue. The VMs are on the same virtual switch. Which method should be used to capture the traffic?

   • AEnable flow logs on the virtual network.
   • BConfigure port mirroring on the virtual switch to send a copy of the traffic to a monitoring VM.
   • CUse the hypervisor's built-in firewall logs.
   • DInstall a packet capture tool on both VMs and capture traffic locally.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization is migrating its data center to a virtualized platform. The compliance team requires that the payment card processing network be isolated from the corporate network. Which virtual network design should be implemented?

   • APlace all VMs on the same virtual network but use different subnets
   • BConnect both networks to the same virtual switch
   • CUse the same virtual network but apply host-based firewalls on each VM
   • DCreate separate virtual networks with no routing between them, and place a firewall if controlled communication is needed
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is deploying a virtual network for a new project. The security policy requires that the database server be accessible only from the application server, and that all other traffic be blocked. The network defender has created two subnets: one for the application and one for the database. What should be configured to enforce the policy?

   • AA route table that directs all traffic to the internet.
   • BA DNS zone that resolves the database hostname only for the application server.
   • CA VPN gateway between the two subnets.
   • DA network security group (NSG) on the database subnet that allows inbound traffic only from the application subnet on the database port.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's virtual network hosts a database that must be accessible only to the application server. The network defender needs to enforce this at the network layer. Which configuration should be used?

   • APlace the database and application server on different virtual networks with no routing.
   • BConfigure the database to listen on all interfaces.
   • CCreate a network security group (NSG) or firewall rule that allows inbound traffic to the database only from the application server's IP address and port.
   • DEnable encryption on the database VM's virtual disk.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization is deploying a new virtualized DMZ. The security team requires that only the web server be reachable from the internet, and that the web server can only communicate with the application server on a specific port. Which virtual network security control should be configured to enforce this policy?

   • AA network tap on the virtual switch
   • BA VLAN with no gateway
   • CDistributed firewall rules on the virtual network
   • DA virtual switch with no uplinks
   Reveal Solution Discussion Select an answer first