Network Segmentation and Perimeter Isolation NDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is designing a network for a new office. They want to separate guest Wi-Fi users from employee workstations and also separate the HR department from the rest of the employees. Which combination of techniques achieves both requirements?

   • ACreate a VLAN for guests, a VLAN for HR, and a VLAN for general employees; use ACLs on the inter-VLAN router to block guest access to all other VLANs and HR access from general employees.
   • BPlace guests and HR in the same VLAN and use a firewall to block guest traffic.
   • CUse a single VLAN for all users and rely on the access point's guest network feature.
   • DCreate separate subnets for each group but do not configure any routing between them.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is testing the effectiveness of a new firewall zone configuration that separates the DMZ from the internal network. The analyst sends a ping from a workstation in the internal network to a server in the DMZ and receives a reply. What does this indicate?

   • AThe firewall is allowing ICMP traffic from the internal network to the DMZ, which may or may not be permitted by policy.
   • BThe firewall is working correctly because the DMZ is reachable from the internal network.
   • CThe firewall is blocking all traffic from the DMZ to the internal network.
   • DThe firewall is misconfigured because internal-to-DMZ traffic should always be blocked.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A hospital network has a public-facing patient portal that must be reachable from the internet, and an internal electronic health record (EHR) system that must never be directly reachable from the internet. The security team wants to enforce isolation while still allowing the portal to query the EHR database. Which design best meets these requirements?

   • APlace the EHR database in the DMZ and the portal in the internal network, with a firewall rule allowing the internal portal to reach the database.
   • BPlace the portal in a DMZ and the EHR database in the internal network, with a firewall rule allowing the portal to initiate connections to the database on the required port.
   • CPlace the portal and the EHR database in the same subnet, and rely on the edge firewall to block inbound traffic to the database.
   • DPlace both systems in the internal network and use a VLAN to separate them, with no firewall rules between the VLANs.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a legacy application that must communicate with a database on a different subnet. The security team wants to segment the network to limit the blast radius, but the application does not support modern authentication and must use a fixed IP address. Which approach provides the best balance between security and functionality?

   • APlace the application and database on the same subnet as the rest of the network and use a proxy to filter traffic.
   • BCreate a separate VLAN for the application and database, and configure a firewall rule that allows only the application's fixed IP to access the database's specific port.
   • CPlace the application and database in the same subnet and rely on the host firewall to restrict access.
   • DMove the database to the DMZ and allow the application to access it through a VPN.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is migrating its on-premises data center to the cloud. The security team wants to replicate the existing network segmentation in the cloud environment. Which approach is the most effective?

   • AUse cloud virtual networks and subnets to create separate segments, and use cloud firewall rules to control traffic between them.
   • BUse a VPN to connect the cloud environment to the on-premises network and rely on the on-premises firewall for all segmentation.
   • CPlace all resources in a single virtual network and use host-based firewalls on each virtual machine.
   • DRely on the cloud provider's default security settings and do not configure any additional segmentation.
   Reveal Solution Discussion Select an answer first