Network Segmentation and Perimeter Isolation NDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team has implemented a new segmentation scheme with multiple VLANs and firewall zones. During a routine review, they find that a critical application is failing because the application server cannot reach the database server. The firewall logs show that the traffic is being blocked. The team needs to restore functionality without weakening the overall segmentation. Which action should they take first?

   • AAdd a rule to allow all traffic between the application server and the database server.
   • BMove the application server and database server to the same VLAN to bypass the firewall.
   • CDisable the firewall temporarily to allow the application to work, then investigate the issue later.
   • DReview the firewall rule base to identify the specific rule that is blocking the traffic and adjust it to allow the required communication while keeping the rest of the segmentation intact.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A small business has a flat network where all devices, including the point-of-sale (POS) system and employee workstations, are on the same subnet. After a malware infection spread from a workstation to the POS system, the owner wants to prevent this from happening again. Which action would most directly address the root cause?

   • AChange the default passwords on the POS system and workstations.
   • BInstall antivirus software on all workstations and the POS system.
   • CSegment the network so the POS system is on a separate VLAN or subnet from employee workstations, with firewall rules controlling any necessary communication.
   • DEnable MAC address filtering on the switch to only allow known devices to connect.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which activity is used to verify that traffic cannot flow between two network segments?

   • ASoftware patch management
   • BTraffic flow analysis
   • CHardware inventory
   • DPassword policy review
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   When designing a segmented network, where should a public-facing web server be placed?

   • AIn the management network
   • BIn the DMZ
   • COn the internal user LAN
   • DIn the internal database segment
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company is planning to deploy a new public-facing web application. The security team wants to ensure that the application is protected from common web attacks, but they also want to minimize the number of open ports on the edge firewall. Which approach best balances these concerns?

   • AUse a reverse proxy in the DMZ that terminates HTTPS and forwards traffic to the web server, but do not use a WAF.
   • BPlace the web server in the internal network and use a VPN for all external access.
   • CPlace a web application firewall (WAF) in the DMZ and configure the edge firewall to allow only HTTPS traffic to the WAF, which then forwards traffic to the web server.
   • DPlace the web server directly on the edge firewall and open all necessary ports for the application.
   Reveal Solution Discussion Select an answer first