Network Segmentation and Perimeter Isolation NDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A retail company wants to separate its point-of-sale (POS) terminals from the corporate user network to limit the spread of malware. The network uses a single flat IPv4 subnet. Which approach provides the most effective isolation with the least administrative overhead?

   • APlace the POS terminals on a separate physical switch and connect that switch directly to the internet uplink.
   • BConfigure the POS terminals with a different subnet mask so they cannot communicate with the corporate network.
   • CCreate two VLANs and configure an access control list on the inter-VLAN router to block all traffic from the corporate VLAN to the POS VLAN.
   • DAssign the POS terminals static IP addresses in the same subnet and rely on the switch's port security to prevent unauthorized devices.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team has implemented a new firewall zone architecture with a DMZ and an internal network. They want to verify that the DMZ cannot initiate connections to the internal network. Which test would provide the most conclusive evidence?

   • ACheck the firewall logs for any denied DMZ-to-internal traffic.
   • BFrom an internal workstation, attempt to connect to a server in the DMZ and observe whether the connection succeeds.
   • CFrom a server in the DMZ, attempt to connect to a port on an internal server and observe whether the connection is blocked.
   • DReview the firewall rule base to confirm that there is no rule allowing DMZ-to-internal traffic.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which benefit is a direct result of network segmentation?

   • AIt automatically patches all vulnerabilities in the network
   • BIt guarantees that malware cannot spread between any two hosts
   • CIt reduces the attack surface by limiting the paths an attacker can use to reach critical systems
   • DIt eliminates the need for encryption on all internal traffic
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A university campus network has separate VLANs for students, faculty, and administrative staff. The security team wants to ensure that students cannot access the administrative VLAN, but faculty should be able to access both the student and administrative VLANs. Which control should be implemented?

   • AConfigure an ACL on the inter-VLAN router that denies traffic from the student VLAN to the administrative VLAN and permits traffic from the faculty VLAN to both.
   • BUse a firewall between the student and administrative VLANs and allow all traffic by default.
   • CDisable inter-VLAN routing entirely so no VLAN can communicate with another.
   • DPlace all VLANs on the same subnet and rely on the switch's MAC address filtering.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which component is a hardened server that is exposed to the internet and acts as a gateway for external connections?

   • ABastion host
   • BPrint server
   • CDNS resolver
   • DDHCP server
   Reveal Solution Discussion Select an answer first