Network Security Architecture GSLC Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which statement best describes the purpose of defense-in-depth in network security architecture?

   • ATo rely on a single, strong security control at the network perimeter
   • BTo ensure that all security controls are managed by a single centralized team
   • CTo eliminate all network vulnerabilities by using the most advanced firewall technology
   • DTo implement multiple layers of security controls so that a failure in one layer does not compromise the entire network
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An e-commerce company wants to ensure its web application remains available even if one of its two internet connections fails. They also want to protect the application from DDoS attacks. Which architecture should they implement?

   • AUse a load balancer to distribute traffic across multiple servers, but keep a single internet connection.
   • BImplement two internet connections from different providers with BGP and a DDoS mitigation service in front of the application.
   • CUse a single, high-capacity internet connection with a DDoS mitigation service.
   • DPlace the web application behind a firewall that has built-in DDoS protection and use only one internet connection.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which action would a NAC system typically take when an unmanaged personal device attempts to connect to the corporate network?

   • APermanently block the device's MAC address from ever connecting
   • BAutomatically grant full access because it is a personal device
   • CPlace the device in a quarantine VLAN with limited access
   • DIgnore the device and allow it to connect without any checks
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS)?

   • AAn IDS monitors traffic and alerts, while an IPS can actively block or drop malicious traffic
   • BAn IDS uses signatures, while an IPS uses only anomaly-based detection
   • CAn IDS is placed inline, while an IPS is placed out-of-band
   • DAn IDS only detects malware on hosts, while an IPS only detects network attacks
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A financial trading firm requires extremely high availability for its trading platform. They are considering a multi-site active-active architecture. However, they are concerned about the complexity of synchronizing state between sites and the potential for split-brain scenarios. Which approach should they take?

   • AUse active-active without any synchronization mechanism, relying on the application to handle conflicts.
   • BUse a single site with redundant hardware to avoid the complexity of multi-site.
   • CUse active-active with a quorum-based system to prevent split-brain, and ensure low-latency links between sites.
   • DUse active-passive failover with a manual switchover to avoid split-brain entirely.
   Reveal Solution Discussion Select an answer first