Which of the following is an example of a segmentation strategy used in cloud networks?

Applying a single firewall rule to all resources

Using subnets to separate different application tiers

Using one flat network for all workloads

A company is migrating a three-tier web application to AWS. The web tier must be reachable from the internet, the application tier should only be reachable from the web tier, and the database tier should only be reachable from the application tier. The security team wants to enforce these boundaries using cloud-native constructs. What is the most appropriate design?

Place all three tiers in the same subnet and use security groups on each EC2 instance to restrict traffic between tiers.

Create one subnet for web and app, and a separate subnet for the database, then use a network ACL to allow all traffic between the two subnets.

Use a single VPC with no subnets and rely on route tables to isolate traffic between tiers.

Create three separate subnets (web, app, db) and configure security groups so that the web SG allows 0.0.0.0/0 on port 443, the app SG allows traffic only from the web SG, and the db SG allows traffic only from the app SG.

A cloud security auditor is assessing the segmentation of a multi-tier application. The auditor discovers that the web tier and the database tier are in the same subnet, but different security groups are applied. The auditor wants to recommend a change that improves isolation without requiring a major architectural redesign. Which recommendation is most appropriate?

Move the database tier to a separate subnet and apply a network ACL that only allows traffic from the web tier's subnet.

Enable VPC flow logs to monitor traffic between the tiers.

Move the web tier to a different VPC and peer it with the database tier's VPC.

Keep the current subnet but add more restrictive security group rules to the database tier.

What is the purpose of auditing security group and network ACL rules as part of compliance checks?

To verify that the rules align with the intended segmentation policy and regulatory requirements

To increase the number of rules to improve security

To automatically update rules based on traffic patterns

To disable all rules to simplify the network

EC-CouncilCloud Security Essentials

Domain 4Objective 2

Network Isolation and Segmentation CSE Practice Questions (Page 6)

Part of the Network Security in the Cloud domain, which makes up ~10% of our current practice bank.

31questions here

7free pages

6concepts

Questions 26–30

26foundation · easy
Which of the following is an example of a segmentation strategy used in cloud networks?
Select an answer first
27application · medium
A company is migrating a three-tier web application to AWS. The web tier must be reachable from the internet, the application tier should only be reachable from the web tier, and the database tier should only be reachable from the application tier. The security team wants to enforce these boundaries using cloud-native constructs. What is the most appropriate design?
Select an answer first
28expert · hard
A cloud security auditor is assessing the segmentation of a multi-tier application. The auditor discovers that the web tier and the database tier are in the same subnet, but different security groups are applied. The auditor wants to recommend a change that improves isolation without requiring a major architectural redesign. Which recommendation is most appropriate?
Select an answer first
29foundation · easy
What is the purpose of auditing security group and network ACL rules as part of compliance checks?
Select an answer first
30foundation · easy
Which security control is used to enforce segmentation policies at the subnet level in a cloud network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSE” is a trademark of its owner, used for identification only.

Network Isolation and Segmentation CSE Practice Questions (Page 6)

Questions 26–30

Which of the following is an example of a segmentation strategy used in cloud networks?

What is the purpose of auditing security group and network ACL rules as part of compliance checks?

Which security control is used to enforce segmentation policies at the subnet level in a cloud network?

Keep studying — Network Security in the Cloud