Securing a Data Center JN0-1103 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A DevOps team frequently deploys new application versions in a data center, and each deployment changes the IP addresses of the workloads. The security team is struggling to keep firewall policies up to date, and sometimes workloads are left without proper security policies. Which approach should be adopted to address this challenge?

   • APlace all workloads in a single security zone and apply a permissive policy.
   • BUse a firewall that only supports IP-based policies and require the network team to update them daily.
   • CAssign static IP addresses to all workloads and manually update firewall policies.
   • DUse automation and orchestration tools to dynamically update firewall policies based on workload metadata and tags.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which technique is commonly used to mitigate a volumetric DDoS attack?

   • AEncrypting all traffic
   • BDisabling the firewall
   • CIncreasing the MTU size
   • DRate limiting
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary goal of microsegmentation in a data center?

   • ATo replace all physical firewalls with virtual firewalls
   • BTo encrypt all traffic between virtual machines
   • CTo reduce the number of security zones in the data center
   • DTo isolate individual workloads and enforce granular security policies between them
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A data center is being designed with a requirement to support multiple tenants, each with its own security policies and compliance requirements. The design must also provide high availability and allow for scaling of firewall throughput without disrupting existing tenants. Which firewall architecture is most suitable?

   • AA firewall per tenant, deployed in active/passive pairs, with no shared infrastructure.
   • BA cluster of virtual firewalls running on commodity servers, with each tenant on a separate VM.
   • CA pair of chassis-based firewalls in an active/active HA configuration, with each tenant assigned to a virtual firewall instance.
   • DA single high-end firewall appliance with multiple security contexts.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial services company is migrating its legacy three-tier application to a virtualized data center. The security team is concerned about lateral movement between the web, application, and database tiers, which currently communicate over a flat L2 network. The company wants to enforce granular security policies between the tiers without deploying a separate physical firewall per tier. Which approach should the security architect recommend?

   • AEnable private VLANs on the access switches to isolate all VMs from each other.
   • BPlace a single high-throughput firewall at the data center edge and rely on VLAN segmentation between tiers.
   • CDeploy a virtual firewall on each hypervisor host and use security groups to filter traffic between VM workloads.
   • DInstall a physical firewall in each rack and route all inter-tier traffic through it.
   Reveal Solution Discussion Select an answer first