Enterprise Virtual Network Security CND Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company hosts a multi-tier web application in a private cloud. The web tier, application tier, and database tier are all on the same virtual network segment. After a breach of the web server, attackers pivoted to the database. Which change should the network defender implement to reduce the blast radius of similar future incidents?

   • APlace each tier in its own virtual network segment and restrict traffic between segments to only the required ports and protocols.
   • BApply a host-based firewall on the database server to block all inbound traffic from the web server.
   • CMove the database to a physical server outside the virtual environment.
   • DEnable encryption on the virtual network to protect data in transit.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A network defender is investigating a suspected compromise of a VM. Which log source would provide the most detailed information about network connections made by the VM?

   • AThe physical switch's SNMP logs
   • BThe hypervisor's system event log
   • CThe DNS server's query log
   • DThe VM's operating system firewall logs
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In a virtual network, what is the role of a virtual firewall?

   • ATo manage the hypervisor's resource allocation.
   • BTo encrypt all traffic between virtual machines and the physical network.
   • CTo filter traffic between virtual machines and enforce security policies.
   • DTo provide a backup of virtual machine data.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following best describes a virtual network in the context of enterprise IT?

   • AA network that is completely isolated from the internet and used only for testing purposes.
   • BA software-defined network that provides logical isolation and connectivity between virtual machines and other virtual resources.
   • CA network that uses only wireless access points and does not require any physical cabling.
   • DA physical network that uses dedicated hardware switches and routers to connect servers and clients.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A network defender must protect a virtual network that hosts a legacy application that cannot be patched. The application is known to be vulnerable to a specific exploit. The defender wants to minimize the risk without taking the application offline. Which control is most effective in this situation?

   • AIncrease the logging level on the application server.
   • BDisable the application's network access entirely.
   • CDeploy a virtual IPS with a signature for the known exploit and place it inline in front of the application.
   • DMove the application to a different virtual network segment.
   Reveal Solution Discussion Select an answer first