Cloud Network Micro Segmentation GCAD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company uses a cloud provider's native security groups to segment workloads. They are considering moving to a distributed firewall solution from a third-party vendor. What is a key advantage of the distributed firewall over native security groups?

   • AIt can enforce policies based on workload attributes such as tags and application names, not just IP addresses and ports.
   • BIt is always cheaper than native security groups.
   • CIt automatically encrypts all traffic between workloads.
   • DIt eliminates the need for any network security monitoring.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security architect is choosing between network-based, hypervisor-based, and host-based segmentation for a new cloud deployment. The deployment includes both Windows and Linux VMs, and the team wants to enforce the same policies across all VMs with minimal performance impact. Which method should be selected?

   • AHypervisor-based segmentation, because it enforces policies at the virtual switch and is OS-agnostic.
   • BNetwork-based segmentation using VLANs, because it is simple and does not require agents.
   • CA combination of network and host-based segmentation, because it is the most secure.
   • DHost-based segmentation using OS firewalls, because it provides the most granular control.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team has deployed micro-segmentation policies across hundreds of workloads. They need to continuously verify that the policies are effective and that no unauthorized traffic is occurring. Which monitoring approach provides the most direct evidence of policy effectiveness?

   • AReview security group rules monthly to ensure they have not changed.
   • BEnable flow logs and configure alerts for any traffic that matches a 'deny' rule.
   • CUse a vulnerability scanner to check for open ports on each workload.
   • DMonitor CPU usage on the firewall appliances to ensure they are not overloaded.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security architect is designing micro-segmentation for a Kubernetes cluster running on VMs in a cloud VPC. The goal is to enforce zero trust by controlling east-west traffic between pods based on labels, not just IP addresses. Which approach best meets this goal?

   • AUse security groups that reference the VM instance IDs of all nodes running the pods.
   • BEnable VPC flow logs and analyze traffic patterns to manually update firewall rules.
   • CCreate network ACLs on each subnet to allow traffic only between pod CIDRs.
   • DDeploy a distributed firewall that integrates with the Kubernetes API to enforce policies based on pod labels and service accounts.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is deploying a new application in a cloud environment. The application consists of multiple VMs that need to communicate with each other on specific ports. The security team wants to implement segmentation with the least operational overhead while still providing granular control. Which method should they choose?

   • AUse network ACLs on the subnets to control traffic between VMs.
   • BUse cloud-native security groups attached to each VM's network interface.
   • CDeploy a third-party distributed firewall appliance in the network path.
   • DInstall host-based firewall agents on each VM and manage them centrally.
   Reveal Solution Discussion Select an answer first