Fundamental Security Architecture Concepts GDSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A small company is building a new network and wants to follow a proven security design. The architect proposes using a reference architecture that includes a DMZ, an internal network, and a management network. What is the primary benefit of using this reference architecture?

   • AIt eliminates the need for ongoing security monitoring.
   • BIt provides a tested blueprint that helps ensure consistent and effective security controls.
   • CIt guarantees that the network will be immune to all attacks.
   • DIt automatically enforces least privilege across all systems.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a common example of a security zone?

   • AA network attached storage (NAS) device used for file sharing
   • BA virtual local area network (VLAN) used for all internal workstations
   • CA demilitarized zone (DMZ) that hosts publicly accessible servers
   • DA wireless access point that provides guest internet access
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is deploying a new partner portal. The portal allows external partners to upload files that are then processed by an internal application. The security team is concerned that a malicious file upload could compromise the internal application. They are considering two designs: (A) place the portal in the DMZ and have it transfer files to an internal staging server, or (B) place the portal in the internal network and have it write files directly to the application server. Which design better respects trust boundaries and why?

   • ADesign B, because placing the portal in the internal network allows the application to process files faster and reduces latency.
   • BNeither design is secure because external partners should never be allowed to upload files.
   • CBoth designs are equally secure because the application scans all files for malware.
   • DDesign A, because the DMZ is a less-trusted zone and the staging server acts as a buffer, preventing direct access from the untrusted partner zone to the internal application.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of a security reference architecture?

   • ATo provide a standardized blueprint that guides the design and implementation of secure systems
   • BTo replace the need for security policies and procedures
   • CTo define the exact hardware specifications for all servers
   • DTo list all known vulnerabilities in a system
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hospital is segmenting its network to protect patient records. The network will have a clinical zone for medical devices, a user zone for staff workstations, and a guest zone for visitor Wi-Fi. Which additional control is most important to ensure that a compromised guest device cannot reach the clinical zone?

   • AImplementing strong encryption on all wireless networks.
   • BDeploying antivirus on all clinical devices.
   • CUsing a single VLAN for all zones to simplify management.
   • DEnforcing strict firewall rules between the guest zone and the clinical zone.
   Reveal Solution Discussion Select an answer first