Securing a Data Center JN0-1103 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key advantage of a chassis-based firewall in a data center?

   • AIt requires no configuration for high availability
   • BIt is designed exclusively for small branch offices
   • CIt provides high port density and scalability by allowing multiple line cards in a single chassis
   • DIt is the only firewall type that supports virtual firewalls
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A data center hosts a public-facing web application, internal business applications, and a management network for administrators. The security team wants to ensure that only necessary traffic flows between these zones. Which design should be implemented?

   • APlace the web servers in a DMZ, internal apps in an internal zone, and management in a separate management zone, with firewalls controlling traffic between zones.
   • BUse a single flat network and apply ACLs only on the core switches.
   • CPut all servers in the same zone and rely on host-based firewalls on each server.
   • DConnect the DMZ directly to the internal zone without any firewall to reduce latency.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A data center is experiencing a high volume of east-west traffic between application tiers. The security team wants to detect and block known exploit attempts without introducing significant latency to the application traffic. Which deployment approach for IPS is most appropriate?

   • ARely on the firewall's stateful inspection to block exploits.
   • BUse a distributed IPS solution that inspects traffic at the hypervisor level, with policies applied per workload.
   • CDeploy a dedicated IPS appliance in inline mode at the core of the data center.
   • DPlace an IPS in passive mode on a SPAN port to monitor traffic without inline blocking.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company's data center is protected by a DDoS mitigation service that uses BGP to redirect traffic to a scrubbing center during an attack. However, the company is concerned about the latency added by the scrubbing center for normal traffic. Which approach can minimize latency for normal traffic while still providing DDoS protection?

   • AAlways route all traffic through the scrubbing center.
   • BConfigure the mitigation service to only redirect traffic to the scrubbing center when an attack is detected, and route normal traffic directly to the data center.
   • CUse a scrubbing center that is geographically closer to the data center.
   • DDeploy an on-premises DDoS mitigation appliance and do not use a cloud scrubbing service.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A data center has a DMZ that hosts web servers, an internal zone for databases, and a management zone for administrators. The web servers need to be patched from a management server located in the management zone. Which traffic flow should be permitted?

   • AAllow all traffic between the DMZ and management zone.
   • BAllow the management server to initiate connections to the web servers on the patching port.
   • CPlace the management server in the DMZ to simplify patching.
   • DAllow the web servers to initiate connections to the management server on any port.
   Reveal Solution Discussion Select an answer first