Network Segmentation and Perimeter Isolation NDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company wants to provide secure remote administration of its internal servers without exposing the servers directly to the internet. They have a budget for one additional device. Which solution is the most appropriate?

   • AConfigure the firewall to allow SSH directly to each internal server from the internet.
   • BUse a VPN concentrator on the internal network and allow VPN traffic from the internet to the concentrator.
   • CDeploy a bastion host in the DMZ and configure the firewall to allow SSH from the internet only to the bastion host; the bastion host then connects to the internal servers.
   • DPlace the internal servers in the DMZ and allow SSH from the internet to them.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is verifying the segmentation between a production network and a development network. The firewall is configured to block all traffic from the development network to the production network. The analyst sends a ping from a development workstation to a production server and receives a reply. What should the analyst do next?

   • ACheck the firewall logs to see if the ping was allowed or denied, and review the rule base for any exceptions or misconfigurations.
   • BIgnore the ping reply because ICMP is not a reliable indicator of firewall behavior.
   • CAssume the firewall is blocking the traffic and the reply is from a cached ARP entry.
   • DConclude that the firewall is working correctly because the ping reply indicates the production server is reachable.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After implementing VLAN segmentation between the finance and HR departments, the security team wants to verify that the isolation is effective. Which test provides the most direct evidence that the segmentation is working?

   • AUse a port scanner from a finance workstation to scan the HR subnet and confirm that no ports respond.
   • BCheck the firewall logs for any blocked traffic between the two VLANs.
   • CVerify that the HR department can still access the internet.
   • DReview the VLAN configuration on the switches to confirm the correct VLAN assignments.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to provide secure remote access for administrators to manage servers inside the internal network without exposing the servers directly to the internet. Which approach best meets this requirement?

   • AOpen the remote management port on the edge firewall and forward it directly to each internal server.
   • BSet up a bastion host in the DMZ and require administrators to connect to the bastion host first, which then allows them to reach the internal servers.
   • CUse a VPN that terminates on the edge firewall and allows full access to the internal network.
   • DPlace the internal servers in the DMZ and allow remote management traffic directly to them.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of network segmentation?

   • ATo replace the need for firewalls and other security devices
   • BTo ensure all devices on the network share the same broadcast domain
   • CTo increase the number of available IP addresses on a network
   • DTo isolate network traffic and limit the attack surface by dividing the network into smaller, controlled zones
   Reveal Solution Discussion Select an answer first