6.4 - Manage Network Security SSCP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network administrator is designing a new network and wants to ensure that management traffic (e.g., SNMP, SSH) is isolated from user data traffic. The administrator also wants to prevent a compromised user device from directly accessing the management interface of network devices. Which design should be implemented?

   • APlace management interfaces on a dedicated management VLAN and restrict access to that VLAN via ACLs.
   • BImplement data plane and control plane separation by using a separate routing protocol for management traffic.
   • CUse the same VLAN for management and user traffic, but encrypt all management protocols.
   • DDisable all management protocols and use only console access for configuration.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the PRIMARY purpose of a VLAN?

   • ATo increase the speed of the network
   • BTo segment network traffic logically on the same physical switch
   • CTo replace the need for a firewall
   • DTo provide physical isolation between networks
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network architect is designing a new data center network. The architect wants to ensure that if the control plane of a switch is overwhelmed by excessive management traffic, the data plane can still forward packets. Which design principle should be applied?

   • APlace all management interfaces on the data plane to reduce complexity.
   • BSeparate the control plane from the data plane, and implement control plane policing to limit management traffic.
   • CDisable all management protocols and use only out-of-band management.
   • DUse a single plane for both management and data traffic to simplify the design.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security administrator is deploying a network intrusion detection system (IDS) to monitor traffic on a critical network segment. The IDS must not introduce latency or become a point of failure. Which placement should be used?

   • APassive placement using a network tap or SPAN port.
   • BVirtual placement in the cloud using a security virtual appliance.
   • CInline placement between the router and the switch.
   • DInline placement with fail-open configuration.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network administrator is configuring VLANs on a switch to separate the finance department from the engineering department. The administrator wants to allow finance to access a shared printer that is in the engineering VLAN, but block all other inter-VLAN traffic. What should the administrator do?

   • AConfigure an ACL on the router (or Layer 3 switch) that permits traffic from the finance VLAN to the printer's IP address and denies all other inter-VLAN traffic.
   • BDisable inter-VLAN routing on the switch and use a separate router for each VLAN.
   • CCreate a new VLAN for the printer and assign both departments to that VLAN.
   • DPlace the printer in the finance VLAN and remove it from the engineering VLAN.
   Reveal Solution Discussion Select an answer first