Network Segmentation and Perimeter Isolation NDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which network design principle helps protect critical assets by placing them in a separate segment with strict access controls?

   • ASingle broadcast domain
   • BFlat network topology
   • CNetwork segmentation with zones
   • DDirect internet exposure for all servers
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's security team is concerned about the spread of ransomware within the network. They want to limit the impact if one workstation is compromised. Which approach would be most effective?

   • AEnable Windows Defender Firewall on all workstations and servers.
   • BSegment the network into smaller zones based on function and restrict communication between zones with firewall rules.
   • CIncrease the frequency of backups to ensure data can be restored.
   • DDeploy an intrusion detection system (IDS) on the core switch to monitor for ransomware activity.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company has a legacy application that cannot be segmented because it requires direct communication between all servers. The security team wants to reduce the risk of lateral movement while keeping the application functional. Which approach is the most practical?

   • ADisable the application's unnecessary services and features to reduce the attack surface.
   • BPlace all servers in the DMZ and rely on the edge firewall to protect them.
   • CUse a VLAN for the application and allow all traffic within the VLAN.
   • DUse host-based firewalls on each server to restrict communication to only the necessary ports and source IP addresses.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A small business has a single internet connection and wants to host a public web server and an email server, while keeping its internal workstations isolated. The budget is limited, so they can only afford one edge firewall. Which topology provides the best isolation?

   • AUse a single flat network and configure the firewall to allow only HTTP and SMTP traffic from the internet.
   • BPut the web and email servers on a separate VLAN and connect them directly to the internet through a switch.
   • CCreate a DMZ using a third interface on the firewall, place the web and email servers there, and keep the workstations on the internal interface.
   • DPlace the web and email servers on the internal network and rely on the firewall to block inbound traffic to the workstations.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of a DMZ (demilitarized zone) in network security?

   • ATo replace the need for a firewall at the network edge
   • BTo provide a secure storage area for backup tapes
   • CTo host services that are accessible from the internet while keeping them isolated from the internal network
   • DTo allow unrestricted traffic between the internet and internal servers
   Reveal Solution Discussion Select an answer first