A company runs a microservices application on Kubernetes. They want to enforce zero-trust micro-segmentation between services. The security team is considering using Kubernetes NetworkPolicies. What is a limitation of NetworkPolicies that they should address?

NetworkPolicies cannot block traffic between pods in the same namespace.

NetworkPolicies only work if the Kubernetes cluster uses a network plugin that supports them, such as Calico or Cilium.

NetworkPolicies can only be applied to namespaces, not to individual pods.

NetworkPolicies require a service mesh to function.

A company runs a stateful application on a pair of VMs that must communicate with each other for replication. The security team wants to enforce micro-segmentation, but the application uses dynamic ports for replication. The VMs are in the same security group. Which approach allows the required communication while maintaining least-privilege?

Place the VMs in separate subnets and use a network ACL that allows only the replication ports.

Use a distributed firewall that supports application-level identity and can allow traffic based on the application process, not just ports.

Use a host-based firewall rule that allows traffic only on the specific replication ports after observing them.

Allow all traffic between the two VMs by referencing the security group ID in the inbound rule.

A company is moving a legacy application from on-premises to the cloud. The application has a mix of VMs and bare-metal servers. The security team wants to implement micro-segmentation that covers both VM and bare-metal workloads with a single policy set. Which approach is most suitable?

Use hypervisor-based segmentation for VMs and network ACLs for bare-metal servers.

Use a host-based segmentation solution that installs agents on both VMs and bare-metal servers.

Use only network-based segmentation with VLANs and ACLs.

Use a cloud-native security group for VMs and a separate host firewall for bare-metal servers.

A security administrator is designing security groups for a multi-tier application. The web tier instances are in an auto scaling group, so their IP addresses change frequently. The app tier must only accept traffic from the web tier. How should the security group rule be configured?

Use the CIDR block of the web tier's subnet as the source.

Use a network ACL rule that allows all traffic from the web tier's subnet.

Use the public IP addresses of the web tier instances as the source.

Use the security group ID of the web tier as the source in the app tier's inbound rule.

Which policy would best control service-to-service communication in a microservices architecture?

Allow all traffic between services to ensure high availability

Block all traffic between services and require manual approval for each request

Use a single shared security group for all services to simplify management

Allow only specific services to communicate on required ports and protocols

GIAC Cloud Security Architecture and Design

Domain 2Objective 2

Cloud Network Micro Segmentation GCAD Practice Questions (Page 8)

Part of the Network Architecture and Security domain, which makes up ~24% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–19 in this domain), expect 3–5 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

8concepts

Questions 36–40

36expert · hard
A company runs a microservices application on Kubernetes. They want to enforce zero-trust micro-segmentation between services. The security team is considering using Kubernetes NetworkPolicies. What is a limitation of NetworkPolicies that they should address?
Select an answer first
37expert · hard
A company runs a stateful application on a pair of VMs that must communicate with each other for replication. The security team wants to enforce micro-segmentation, but the application uses dynamic ports for replication. The VMs are in the same security group. Which approach allows the required communication while maintaining least-privilege?
Select an answer first
38expert · hard
A company is moving a legacy application from on-premises to the cloud. The application has a mix of VMs and bare-metal servers. The security team wants to implement micro-segmentation that covers both VM and bare-metal workloads with a single policy set. Which approach is most suitable?
Select an answer first
39application · medium
A security administrator is designing security groups for a multi-tier application. The web tier instances are in an auto scaling group, so their IP addresses change frequently. The app tier must only accept traffic from the web tier. How should the security group rule be configured?
Select an answer first
40foundation · easy
Which policy would best control service-to-service communication in a microservices architecture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.