Network Segmentation and Perimeter Isolation NDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company's edge firewall is configured to allow inbound HTTPS traffic to a web server in the DMZ. The security team wants to verify that the firewall is actually blocking all other inbound traffic to the DMZ. Which action provides the most reliable verification?

   • ACheck the firewall's log for any denied inbound traffic.
   • BPerform an external port scan against the DMZ's public IP address and confirm that only port 443 is open.
   • CReview the firewall rule base to confirm that only HTTPS is allowed.
   • DUse a vulnerability scanner on the internal network to scan the DMZ server.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After implementing VLAN segmentation between the finance and HR departments, the security team wants to verify that no traffic can cross between the two VLANs except through the approved firewall. Which test would most directly confirm this?

   • AAttempt to access an HR file share from a finance workstation and confirm access is denied.
   • BUse a protocol analyzer on the finance VLAN to capture all broadcast traffic and verify no HR MAC addresses appear.
   • CCheck the VLAN configuration on the switch to ensure both VLANs are assigned to the correct ports.
   • DFrom a finance workstation, attempt to ping an HR workstation's IP address and confirm the ping fails.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a DMZ that hosts a web server and an email server. The internal network hosts a database server and employee workstations. The security team wants to ensure that if the web server is compromised, the attacker cannot easily reach the internal network. Which additional control would be most effective?

   • AConfigure the firewall to block all traffic from the DMZ to the internal network except for the specific ports and protocols required for the web server to reach the database.
   • BRely on the host-based firewall on the database server to block unauthorized traffic.
   • CUse a single firewall rule to allow all traffic from the DMZ to the internal network.
   • DPlace the database server in the DMZ with the web server to simplify the rule set.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A manufacturing company wants to isolate its industrial control system (ICS) network from the corporate IT network to protect against malware. The ICS network uses legacy devices that do not support VLAN tagging. Which segmentation approach is most appropriate?

   • AConnect the ICS network directly to the internet and use a VPN for remote access.
   • BPlace the ICS devices on the same subnet as the IT network and rely on host-based firewalls.
   • CUse a router with access control lists to filter traffic between the two networks.
   • DConfigure VLANs on the switch and assign the legacy devices to a VLAN.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has a network with multiple departments. The security team wants to ensure that the R&D department cannot access the HR department's file server, but both departments need to access the internet. Which segmentation method would be the most efficient to implement?

   • AInstall a host-based firewall on the HR file server to block R&D IP addresses.
   • BCreate separate VLANs for R&D and HR, and configure firewall rules to block traffic from R&D to the HR file server while allowing both to reach the internet.
   • CPlace the HR file server on a different subnet and rely on the default gateway to block R&D traffic.
   • DUse MAC address filtering on the HR file server to only allow HR workstations.
   Reveal Solution Discussion Select an answer first