Network Security Architecture GSLC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A cloud service provider wants to implement micro-segmentation for its multi-tenant environment. The goal is to prevent lateral movement between tenants while maintaining performance. Which technology should be used?

   • AUse a central firewall to filter traffic between all tenants.
   • BUse software-defined networking (SDN) with distributed firewalls to enforce micro-segmentation.
   • CUse network address translation (NAT) to hide tenant IP addresses.
   • DUse traditional VLANs to separate tenants.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is moving a legacy application to a microservices architecture. The security team wants to implement micro-segmentation to limit lateral movement. However, the application has some services that need to communicate with each other, and the team is concerned about the operational overhead of managing many firewall rules. Which approach balances security and manageability?

   • ACreate a separate VLAN for each microservice and manually configure firewall rules for each communication path.
   • BPlace all microservices in a single VLAN and rely on host-based firewalls on each service.
   • CImplement micro-segmentation using a software-defined networking (SDN) controller that centralizes policy management and automates rule updates.
   • DUse a traditional firewall between the application tiers, but do not segment within a tier.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which component is a primary building block of a layered network security architecture?

   • AA single password policy applied to all users
   • BA set of layered controls including perimeter firewalls, internal segmentation, and endpoint protection
   • CA demilitarized zone (DMZ) that hosts externally accessible services
   • DA virtual private network (VPN) for all remote users
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A hospital's network has a primary data center and a disaster recovery (DR) site. The network team wants to ensure that if the primary site fails, the DR site can take over with minimal downtime. They have a budget for redundant network links and equipment. Which approach provides the best resilience while balancing cost?

   • AUse a single firewall at the primary site and rely on the cloud for DR.
   • BUse active-active load balancing across both sites, with all traffic distributed between them.
   • CUse active-passive failover for the network gateway, with a redundant internet connection at the DR site, and replicate firewall configurations.
   • DKeep the DR site offline and manually bring it up when needed, using a single internet connection.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A global company has remote employees in multiple countries. They need to provide secure remote access to internal applications, but they also need to comply with data residency regulations that require certain data to remain in specific geographic regions. Which remote access architecture best meets these requirements?

   • AUse a cloud-based VPN service that is available in multiple regions, but do not control which region is used.
   • BUse a remote desktop gateway that allows users to access desktops in the headquarters data center.
   • CDeploy regional VPN gateways in each required region, and route users to the gateway in their region.
   • DUse a single VPN gateway in the company's headquarters and route all remote users through it.
   Reveal Solution Discussion Select an answer first