Network Isolation and Segmentation CSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A cloud architect is designing a network for a multi-tier application in Azure. The architect wants to use micro-segmentation to isolate each tier. Which Azure construct is best suited for this purpose?

   • AAzure Firewall deployed in a hub VNet.
   • BNetwork security groups (NSGs) applied to subnets and network interfaces.
   • CAzure Virtual Network peering.
   • DAzure Route Tables.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization is planning to deploy a multi-tier application in a cloud VPC. The security team requires that the web tier and the application tier be in different subnets, and that the application tier can only be accessed by the web tier. Which additional control should be implemented to enforce this at the subnet level?

   • AUse a separate VPC for the application tier and peer it with the web tier's VPC.
   • BConfigure a security group on the application tier instances to allow inbound traffic from the web tier's security group.
   • CConfigure a network ACL on the application subnet to allow inbound traffic only from the web subnet's CIDR.
   • DPlace the application tier in the same subnet as the web tier but use a security group to restrict access.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security architect is designing a zero-trust network for a cloud environment. The architect wants to implement micro-segmentation to ensure that each workload can only communicate with specific other workloads. The environment has hundreds of workloads, and the architect wants to avoid managing individual IP addresses. Which approach is most effective?

   • AUse separate VPCs for each workload and peer them all together.
   • BUse a single security group for all workloads and rely on the cloud provider's default deny.
   • CUse security groups that reference other security groups as sources and destinations.
   • DUse network ACLs with specific IP ranges for each workload.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary role of a security group in a cloud network?

   • ATo act as a stateful firewall that controls inbound and outbound traffic for associated resources
   • BTo encrypt data in transit between resources
   • CTo route traffic between different subnets
   • DTo provide a private IP address to each resource
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the difference between a security group and a network ACL in a cloud environment?

   • ASecurity groups are stateless, while network ACLs are stateful
   • BBoth are stateful and automatically allow return traffic
   • CBoth are stateless and require explicit rules for return traffic
   • DSecurity groups are stateful, while network ACLs are stateless
   Reveal Solution Discussion Select an answer first