Cloud Network Micro Segmentation GCAD Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of a security group in a cloud environment?

   • ATo act as a stateful firewall that controls inbound and outbound traffic for associated resources
   • BTo provide a stateless packet filter for an entire subnet
   • CTo encrypt traffic between instances
   • DTo replace the need for identity and access management
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is designing security groups for a shared services VPC that hosts Active Directory and monitoring tools. Multiple application VPCs need to access these services. The security team wants to avoid managing individual IP addresses and ensure that new application VPCs can be onboarded without updating security group rules. Which design is most effective?

   • AUse a network ACL in the shared services VPC that allows all traffic from the application VPC CIDRs.
   • BUse a central security group in the shared services VPC and reference it from application VPC security groups.
   • CPlace all application VPCs in the same security group as the shared services.
   • DCreate a security group in each application VPC and add the shared services CIDR to its rules.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security architect is evaluating a distributed firewall for a cloud environment. The firewall will enforce micro-segmentation policies. Which capability is most important for the firewall to support zero-trust principles?

   • AThe ability to encrypt all traffic between workloads.
   • BThe ability to block all inbound traffic from the internet.
   • CThe ability to enforce policies based on workload identity, such as tags or service accounts, rather than only IP addresses.
   • DThe ability to log all traffic for compliance purposes.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security architect is explaining micro-segmentation to management. Which statement accurately describes how micro-segmentation supports a zero trust architecture?

   • AIt creates a strong perimeter around the cloud environment to block external threats.
   • BIt ensures that all workloads are placed on separate physical servers.
   • CIt enforces least-privilege access between workloads, assuming no implicit trust based on network location.
   • DIt replaces all other security controls, such as identity management and encryption.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team must choose a segmentation method for a mixed environment that includes VMs on a hypervisor and containerized workloads on Kubernetes. The goal is to enforce consistent micro-segmentation policies across both environments without modifying the applications. Which approach is most appropriate?

   • AUse hypervisor-based segmentation for VMs and host-based segmentation for containers, with separate policy management.
   • BRely on network-based segmentation using VLANs and subnets for both VMs and containers.
   • CDeploy a distributed firewall that integrates with both the hypervisor and Kubernetes, providing a single policy framework.
   • DImplement host-based firewalls on every VM and container node, configuring rules manually.
   Reveal Solution Discussion Select an answer first