Network Defenses GDSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is redesigning its network to improve security. They have a limited budget and need to choose between implementing network segmentation with VLANs and firewalls, or deploying an advanced IPS. The company's primary concern is preventing lateral movement of an attacker who compromises a single workstation. Which approach is more aligned with their concern?

   • AFocus on host-based security controls on each workstation, such as endpoint detection and response (EDR).
   • BImplement network segmentation with VLANs and firewall rules to restrict traffic between segments.
   • CImplement both segmentation and IPS, but only if the budget allows.
   • DDeploy an advanced IPS that can detect and block malicious traffic across the entire network.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A small business has a single firewall at the internet edge and no internal security controls. After a malware infection spread from one workstation to the file server, the owner wants to add layers of defense to prevent similar incidents. Which combination of controls best implements defense-in-depth?

   • AImplement a VPN for remote access and require multi-factor authentication for all users.
   • BInstall antivirus on all workstations and servers and schedule weekly scans.
   • CAdd an internal firewall segmenting the server VLAN, deploy an IPS on the core switch, and enable host-based firewalls on all endpoints.
   • DUpgrade the edge firewall to a next-generation firewall with application control and enable logging.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company allows employees to work from home. The security team wants to ensure that remote workers can securely access internal applications without exposing the entire internal network to the internet. Which solution should they implement?

   • AProvide remote workers with a remote desktop solution that is accessible from the internet without additional security controls.
   • BUse a network access control (NAC) solution to check the health of remote devices before they connect to the internet.
   • COpen all necessary ports on the firewall to allow remote workers to connect directly to internal servers.
   • DDeploy a VPN concentrator that requires multi-factor authentication and encrypts all traffic between the remote device and the corporate network.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A financial institution is redesigning its network to separate the trading floor from the back-office systems. The trading floor needs low-latency access to market data feeds, while the back-office systems must be heavily protected. The security team wants to minimize the risk of lateral movement from the trading floor to the back-office. Which architecture best balances performance and security?

   • APut the trading floor and back-office on the same VLAN to minimize latency, and rely on host-based firewalls on back-office systems.
   • BPlace the trading floor and back-office in separate VLANs with a stateful firewall between them, allowing only specific ports for necessary communication.
   • CDeploy an IPS in inline mode between the trading floor and the back-office to inspect all traffic.
   • DUse a router with ACLs to filter traffic between the two segments, but allow all traffic from the trading floor to the back-office to avoid latency.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company wants to implement NAC to control access to its network. They have a mix of company-owned and personal devices. The security team wants to enforce a policy that only allows company-owned devices with up-to-date antivirus to access the network, but they also want to allow guests to access the internet only. Which NAC configuration is most appropriate?

   • AConfigure NAC to require all devices, including guests, to have up-to-date antivirus before granting any network access.
   • BConfigure NAC to block all personal devices from the network entirely.
   • CConfigure NAC to place company-owned devices that pass posture checks on the corporate network, and place all other devices on a guest network with internet-only access.
   • DConfigure NAC to allow all devices to access the corporate network, but log their compliance status.
   Reveal Solution Discussion Select an answer first