Network Isolation and Segmentation CSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is monitoring network traffic important for evaluating the effectiveness of network segmentation?

   • AIt helps detect unexpected traffic flows that may indicate a segmentation policy failure
   • BIt replaces the need for security groups and network ACLs
   • CIt automatically blocks all unauthorized traffic
   • DIt ensures that all traffic is encrypted
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security architect is designing a multi-account AWS environment to isolate development, test, and production workloads. The architect wants to ensure that a compromise in the development environment cannot easily pivot to production. Which approach best achieves this goal?

   • ACreate separate AWS accounts for dev, test, and prod, and use VPC peering only where explicitly required, with strict security group rules.
   • BUse a single account but create separate VPCs for each environment and peer them all together for easier management.
   • CUse a single account and a single VPC with no subnets, relying on security groups to isolate environments.
   • DPlace all workloads in a single VPC but use different subnets for dev, test, and prod, with security groups controlling access.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can you isolate different application tiers (e.g., web, application, database) within a single VPC?

   • ABy assigning the same IP address to all tiers
   • BBy using a single route table for all subnets
   • CBy placing each tier in its own subnet and controlling traffic with security groups
   • DBy disabling the firewall on all instances
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is deploying a new application in the cloud and wants to separate its development and production environments. The company wants to minimize costs and management overhead while still ensuring that development cannot affect production. Which approach is most appropriate?

   • AUse a single VPC and rely on the cloud provider's default isolation.
   • BUse two separate VPCs, one for development and one for production.
   • CUse a single VPC with separate security groups for development and production.
   • DUse a single VPC with separate subnets for development and production.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security auditor is reviewing the network segmentation of a cloud environment and wants to verify that the segmentation is effective. The auditor has access to the cloud provider's monitoring tools. Which of the following is the most reliable way to verify that traffic between segments is restricted?

   • AUse flow logs to analyze actual traffic patterns and identify any traffic that violates the segmentation policy.
   • BPerform a penetration test from outside the network to see if the segmentation can be bypassed.
   • CReview the security group rules and network ACL rules to ensure they are configured correctly.
   • DCheck the route tables to ensure that there are no routes between segments.
   Reveal Solution Discussion Select an answer first