Network Security Architecture GSLC Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An online service provider wants to ensure that its web application remains available even if one of its data centers fails. The application is stateless and can run in multiple locations. Which architecture best meets this availability requirement?

   • AIncrease the capacity of the servers in the primary data center to handle more load.
   • BUse a single data center with redundant power and network connections.
   • CDeploy the application in two geographically separated data centers with a load balancer that can fail over traffic.
   • DPlace the application behind a firewall with a redundant pair of firewalls.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company has remote employees who need to access internal applications from home. The security team wants to ensure that all traffic between the remote employee and the internal network is encrypted and that only authorized employees can connect. They also want to minimize the attack surface by not exposing the entire internal network to remote users. Which solution best meets these requirements?

   • AUse a remote desktop protocol (RDP) gateway to allow employees to connect to their office desktops.
   • BExpose the internal applications directly to the internet through port forwarding on the firewall.
   • CImplement a site-to-site VPN between each employee's home router and the corporate firewall.
   • DDeploy a remote access VPN with multi-factor authentication and split tunneling so that only traffic destined for internal networks goes through the VPN tunnel.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which component is essential for authenticating remote users in a VPN solution?

   • AA public web server in the DMZ
   • BA network load balancer
   • CA digital certificate or multi-factor authentication (MFA) mechanism
   • DA network intrusion detection system (IDS)
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company is deploying NAC to control access to its wired network. They have a mix of managed and unmanaged devices, and they want to ensure that unmanaged devices can only access the internet, not internal resources. However, they also want to avoid disrupting the productivity of users with managed devices. Which NAC deployment strategy should they use?

   • AUse a captive portal for all devices, requiring users to enter credentials before accessing the network.
   • BUse MAC address filtering to allow only known devices on the network.
   • CUse 802.1X authentication with dynamic VLAN assignment, placing unmanaged devices in a guest VLAN and managed devices in the corporate VLAN.
   • DDeploy NAC in monitor mode only, logging device types but not enforcing access.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A healthcare organization needs to detect potential data exfiltration from its internal network. They have a SIEM but are not collecting network flow data. Which action would most improve their detection capability?

   • AEnable NetFlow or similar flow logging on routers and switches and send the data to the SIEM.
   • BConduct regular vulnerability scans of internal systems.
   • CDeploy more intrusion detection sensors on the network.
   • DIncrease the retention period for server logs.
   Reveal Solution Discussion Select an answer first