Security Architecture Overview GMON Practice Questions (Page 8)

Questions 36–39

1. 36foundation · easy

   Which security architecture component is designed to aggregate and correlate log data from multiple sources to provide a centralized view of security events?

   • ASIEM
   • BNetwork Access Control (NAC)
   • CIntrusion Prevention System (IPS)
   • DWeb Application Firewall (WAF)
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A multinational corporation is adopting a security architecture framework to support continuous monitoring across its global operations. The CISO wants to ensure that monitoring requirements are derived from business risk and that the architecture can adapt to changing regulatory requirements. The team is considering SABSA and TOGAF. Which approach best satisfies the CISO's requirements?

   • AUse only SABSA, as it is the only framework that supports continuous monitoring.
   • BUse ISO 27001 controls directly as the architecture framework, since they are internationally recognized.
   • CUse only TOGAF, as it is the industry standard for enterprise architecture and includes security considerations.
   • DUse SABSA to define business-driven security architecture and map monitoring requirements to business processes, then use TOGAF for the overall enterprise architecture.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is redesigning its network to isolate a new customer-facing web application from internal systems. The security architect proposes placing the web servers in a DMZ, with firewalls on both sides. The monitoring team needs to see traffic between the web servers and the internal application servers. Where should the monitoring team collect data to meet this requirement?

   • AOn the core switch in the internal network
   • BOn the web servers' host-based firewall only
   • COn the internal firewall between the DMZ and the internal network
   • DOn the external firewall between the internet and the DMZ
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security architect is reviewing a network that uses a single DMZ for both web servers and email servers. The email server was compromised and used to attack the web servers. The architect wants to reduce the risk of lateral movement between services in the DMZ. Which change is most effective?

   • AMove the email server to the internal network and keep the web server in the DMZ.
   • BSplit the DMZ into separate zones for web and email, with firewall rules allowing only necessary traffic between them.
   • CAdd an IDS to the DMZ to detect attacks between the servers.
   • DUse a single firewall with more restrictive rules between the DMZ and the internal network.
   Reveal Solution Discussion Select an answer first