Network Security Architecture GSLC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary role of a demilitarized zone (DMZ) in a secure network design?

   • ATo host services that must be accessible from untrusted networks while isolating them from the internal network
   • BTo store backup data for all internal servers
   • CTo provide a high-speed connection between internal users and the internet
   • DTo allow unrestricted traffic from the internet to internal workstations
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company allows employees to connect personal laptops to the corporate Wi-Fi. The security team wants to ensure that only devices with up-to-date antivirus and full-disk encryption can access the internal network, while guests get internet-only access. Which approach should be implemented?

   • AConfigure the wireless access points to use WPA2-Enterprise and require a pre-shared key for all users.
   • BUse a VPN for all personal laptop access and require multi-factor authentication.
   • CImplement a firewall rule that blocks all traffic from personal laptops to the internal network.
   • DDeploy network access control (NAC) that checks device posture and places compliant devices on the corporate VLAN and non-compliant devices on a guest VLAN.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A large enterprise is architecting its network security monitoring. They have a high-bandwidth core network and want to detect both known and unknown threats. They are considering deploying an IPS inline and a network TAP with an IDS. However, they are concerned about the performance impact of inline inspection. Which strategy best balances detection capability and performance?

   • ADeploy the IPS inline only at the internet edge, and use TAPs with IDS on internal segments to monitor east-west traffic.
   • BDeploy IPS inline on all internal segments, even if it introduces latency.
   • CDeploy IPS inline only on the internal segments, and use TAPs on the internet edge.
   • DUse only passive IDS everywhere, without any inline blocking.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Why is centralized logging important in a network monitoring strategy?

   • AIt eliminates the need for network monitoring tools
   • BIt reduces the amount of storage needed for logs
   • CIt provides a single repository for analyzing and correlating security events across multiple devices
   • DIt automatically blocks malicious traffic
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A university wants to host a public web server for course registration while keeping the internal student database separate. The web server must be reachable from the internet, but the database must not be directly accessible from the internet. Which design pattern should be used?

   • APlace the web server in a DMZ and the database in the internal network, with firewall rules allowing only the web server to access the database.
   • BUse a reverse proxy in front of the database to hide it from the internet.
   • CPut the database on the same VLAN as the web server and rely on the web application to restrict access.
   • DPlace both the web server and database in the DMZ to simplify firewall rules.
   Reveal Solution Discussion Select an answer first