4.3 - Understand Network Security Infrastructure CC Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A hospital is deploying a new network for its Internet of Things (IoT) medical devices, such as infusion pumps and patient monitors. The security team wants to ensure that if one IoT device is compromised, the attacker cannot easily reach the hospital's main electronic health record (EHR) system. Which approach best achieves this isolation?

   • APlace all IoT devices on a dedicated VLAN with firewall rules that block traffic to the EHR system's subnet.
   • BConnect the IoT devices directly to the same switch as the EHR servers to reduce latency.
   • CUse a VPN for all IoT devices to encrypt their traffic.
   • DAssign static IP addresses to all IoT devices to improve tracking.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A manufacturing company has a flat network where all devices—including robotic assembly machines, employee workstations, and the public-facing web server—share the same subnet. After a malware infection spread from an employee laptop to the industrial control systems, the security team must isolate the robotic machines from general employee traffic while still allowing the web server to be reachable from the internet. Which two segmentation strategies should the team implement?

   • APlace the web server in a DMZ and put the robotic machines on a separate VLAN with strict firewall rules.
   • BConnect the robotic machines to a VPN and place the web server on the same VLAN as employee workstations.
   • CPut the web server and robotic machines on the same VLAN, and use a firewall to block all inbound internet traffic.
   • DUse micro-segmentation for the web server only, and leave the robotic machines on the flat network.
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   A financial services firm wants to protect its customer database from both external attackers and insider threats. The security architect proposes a layered approach: a perimeter firewall, an intrusion prevention system (IPS), network segmentation, and strict access controls on the database servers. What is the primary security benefit of this multi-layered strategy?

   • AIt ensures that if one security control fails or is bypassed, additional layers still protect the critical assets.
   • BIt eliminates the need for regular security monitoring and incident response procedures.
   • CIt guarantees that no external attacker can ever penetrate the network perimeter.
   • DIt simplifies the network architecture by reducing the number of security devices required.
   Reveal Solution Discussion Select an answer first