10.1 Assess Private Cloud Scope and Capacity Requirements NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A private cloud is being designed with a micro-segmentation strategy. The security team wants to enforce policies between application tiers. They are considering using VM-Series firewalls on each hypervisor. What is the primary benefit of this distributed enforcement approach?

   • AIt reduces the load on the core firewall
   • BIt guarantees lower latency for all traffic
   • CIt simplifies policy management by centralizing rules in one place
   • DIt eliminates the need for a core firewall
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A private cloud core firewall is being sized for a new deployment. The environment will have 200 VMs in the DMZ and 800 VMs in the internal network. The DMZ VMs will communicate with the internal VMs, and the internal VMs will communicate with each other. The security team wants to enforce micro-segmentation between all VMs. What is the most important capacity consideration for the core firewall?

   • AThe number of virtual systems supported
   • BThe firewall's maximum sessions and throughput with threat prevention
   • CThe firewall's IPsec VPN throughput
   • DThe firewall's SSL decryption throughput
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A private cloud core firewall is being sized to handle inter-zone traffic between application tiers. The environment has 500 virtual servers generating a total of 10 Gbps of east-west traffic, but the firewall will only see traffic that crosses zone boundaries. The security team expects 40% of the traffic to be inspected with threat prevention. What is the most important factor when selecting the core firewall model?

   • AThe firewall's maximum firewall throughput rating
   • BThe number of virtual wire interfaces
   • CThe session table size
   • DThe threat prevention throughput rating
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A private cloud has 1,000 VMs in a single hypervisor cluster. The security team wants to implement micro-segmentation to isolate workloads. They are considering using a centralized firewall in the core versus distributed enforcement via VM-Series firewalls on each hypervisor. The environment has a mix of high-throughput storage traffic and low-latency application traffic. What is the most important trade-off to consider?

   • ACentralized enforcement provides better security because it inspects all traffic
   • BDistributed enforcement requires more VLANs than centralized enforcement
   • CCentralized enforcement reduces management overhead but may introduce latency for east-west traffic
   • DDistributed enforcement is always more scalable than centralized enforcement
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which consideration is most important when sizing core firewalls for high availability in a private cloud?

   • AEnsuring each firewall can handle the full load alone
   • BMinimizing the number of interfaces
   • CChoosing firewalls with identical serial numbers
   • DUsing the same physical location for both firewalls
   Reveal Solution Discussion Select an answer first