Network Security Architecture GSLC Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company is implementing a bring-your-own-device (BYOD) policy. They want to allow personal smartphones and tablets to access the internet and a few corporate web applications, but not the internal file shares. Which NAC configuration would achieve this?

   • ABlock all BYOD devices from the network and require them to use a guest Wi-Fi network with no access to corporate resources.
   • BPlace all BYOD devices in a separate VLAN with firewall rules allowing only web application traffic and internet access.
   • CUse NAC to check that BYOD devices have a corporate certificate, and then give them full network access.
   • DAllow BYOD devices on the same VLAN as corporate devices and rely on user education to avoid accessing file shares.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A small business wants to improve its network security without a large budget. They currently have a single firewall and no internal segmentation. Which defense-in-depth improvement would be most effective for the money?

   • APurchase a more expensive next-generation firewall with advanced threat protection.
   • BImplement VLAN segmentation to separate the finance department from the general user network.
   • CAdd a second firewall in series to create a DMZ for public-facing servers.
   • DDeploy an intrusion detection system (IDS) to monitor network traffic.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A financial firm is deploying a new internet-facing web application. The security architect wants to detect and block known attack patterns while also logging all traffic for forensic analysis. The solution must not introduce a single point of failure for the application. Which architecture best meets these needs?

   • AConfigure the web server's host firewall to block malicious IPs and rely on its access logs for forensics.
   • BDeploy a passive intrusion detection system (IDS) that monitors a copy of the traffic and logs alerts, while the firewall handles blocking.
   • CUse a next-generation firewall with IPS capabilities in a high-availability pair, and send logs to a SIEM.
   • DPlace an inline intrusion prevention system (IPS) in front of the web server and configure it to log all traffic to a central SIEM.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security architect is reviewing the network design for a new data center. The design includes multiple layers of firewalls, IDS/IPS, and network segmentation. The architect wants to ensure that the design provides defense-in-depth without introducing unnecessary complexity. Which approach best achieves this?

   • AMinimize the number of security controls to reduce complexity.
   • BImplement a layered security model where each layer provides a different type of control, such as perimeter firewall, internal segmentation, and host-based controls.
   • CUse the same type of firewall at every layer to ensure consistency.
   • DPlace all security controls at the network perimeter to simplify management.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A university is designing a network for its research lab that handles sensitive data. The lab's systems must be isolated from the student network, but researchers need to access the internet for literature searches. Which network design best meets these requirements?

   • AUse a VPN for all lab internet access, forcing all traffic through the university's central firewall.
   • BConnect the lab systems directly to the student network and rely on host-based firewalls for protection.
   • CPlace the lab systems in a separate VLAN with a firewall that allows outbound internet access but blocks inbound connections from the student network.
   • DPut the lab systems in the DMZ along with the public web servers.
   Reveal Solution Discussion Select an answer first