Network Isolation and Segmentation CSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does network isolation help contain a security breach in a cloud environment?

   • ABy automatically deleting all compromised resources
   • BBy blocking all outbound internet traffic from the entire cloud
   • CBy preventing the attacker from moving laterally to other segments
   • DBy encrypting all data stored in the compromised segment
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing the network architecture of a cloud environment. The environment has a single VPC with multiple subnets, and all resources are in the same security group. The analyst wants to reduce the attack surface and contain a potential breach. Which change would be most effective?

   • AMove all resources to a single subnet to simplify management.
   • BRemove all security groups to avoid misconfiguration.
   • CCreate separate security groups for different workload types and apply them to the respective resources.
   • DEnable flow logs but keep the current security group configuration.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which cloud network construct provides a logically isolated section of the cloud where you can launch resources in a virtual network that you define?

   • AInternet gateway
   • BVirtual Private Cloud (VPC)
   • CSecurity group
   • DNetwork ACL
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large enterprise is migrating to a multi-cloud environment (AWS and Azure) and wants to enforce consistent network isolation between application tiers across both clouds. The security team requires that the web tier in AWS can communicate with the application tier in Azure, but the database tier in either cloud must not be reachable from the other cloud. They also need to audit all cross-cloud traffic. What is the most appropriate approach?

   • APlace all workloads in a single cloud provider to avoid cross-cloud complexity.
   • BUse VPC peering between AWS and Azure VPCs and rely on security groups and NSGs to control traffic.
   • CEstablish a site-to-site VPN between the AWS VPC and Azure VNet, and use security groups/NSGs on each side to allow only the required traffic between web and app tiers.
   • DUse Azure ExpressRoute and AWS Direct Connect to connect the two clouds directly.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team has implemented network segmentation in their cloud environment. To ensure the segmentation is effective, they want to continuously verify that traffic between segments is restricted as intended. Which approach is most effective for this verification?

   • ADisabling all logging to reduce noise and relying on periodic penetration tests.
   • BReviewing security group rules periodically and manually testing connectivity between segments.
   • CUsing a single security group for all segments to simplify management.
   • DEnabling VPC Flow Logs and analyzing them for traffic that should not be occurring between segments.
   Reveal Solution Discussion Select an answer first