Cloud Network Micro Segmentation GCAD Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization is adopting a zero trust model for its cloud environment. The security architect wants to ensure that every service-to-service communication is authenticated, authorized, and encrypted, regardless of the underlying network. Which approach best aligns with zero trust principles?

   • AUse a cloud provider's native security groups to allow traffic only from known IP addresses.
   • BImplement a VPN gateway that encrypts all traffic entering and leaving the cloud environment.
   • CSegment the network into multiple VLANs and apply ACLs between them to restrict traffic.
   • DDeploy a distributed firewall that enforces policies based on workload identity and encrypts traffic between workloads using mutual TLS.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has a legacy application that runs on a single VM and communicates with a database on another VM. The security team wants to implement micro-segmentation without changing the application. Which segmentation method is most suitable for this scenario?

   • AApplication-level segmentation by modifying the application to use mutual TLS.
   • BHost-based segmentation using the operating system firewall on each VM.
   • CHypervisor-based segmentation using the hypervisor's distributed firewall.
   • DNetwork-based segmentation using separate subnets and network ACLs.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security architect is explaining micro-segmentation to a project manager. The project manager asks: 'How does micro-segmentation reduce the blast radius of a compromised workload?' Which response is most accurate?

   • AIt encrypts all traffic between workloads, making it unreadable to an attacker.
   • BIt automatically patches vulnerabilities in workloads, preventing exploitation.
   • CIt isolates workloads into separate VPCs, so an attacker cannot cross VPC boundaries.
   • DIt limits the lateral movement of an attacker by restricting communication to only the required paths between workloads.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   After mapping communication flows, what is the next logical step in a micro-segmentation implementation?

   • ADisconnect all workloads from the network
   • BDesign security policies based on the identified flows
   • CPurchase additional firewall appliances
   • DImmediately enforce strict deny-all policies
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is east-west traffic in a cloud network?

   • ATraffic between different cloud providers
   • BTraffic between the cloud and an on-premises data center
   • CTraffic between workloads or services within the same cloud environment
   • DTraffic between a user's device and the cloud
   Reveal Solution Discussion Select an answer first