8.5 Confirm and Design to Device Security Capabilities NETWORK-SECURITY-ARCHITECT Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A retail chain has deployed IoT Security and wants to enforce micro-segmentation for its smart signage devices. The security team needs to ensure that these devices can only communicate with the content management server and cannot reach other internal subnets. They plan to use dynamic address groups in the firewall policy. What is required to make this work?

   • AConfigure the firewall to learn device types from NetFlow data and create policies accordingly.
   • BDeploy a separate firewall per device type to enforce segmentation.
   • CManually create a static address group containing the IP addresses of all signage devices.
   • DUse the IoT Security device context to populate a dynamic address group that the firewall policy references.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A university's IT security team uses IoT Security to monitor smart building controllers. They want to automatically quarantine a device when a high-risk vulnerability is detected, but they also want to avoid disrupting critical building services. Which workflow should they implement?

   • AIgnore the vulnerability if the device is critical and rely on compensating controls.
   • BCreate an alert that notifies the security team, who then manually review and decide whether to quarantine.
   • CAutomatically quarantine the device only if the vulnerability is actively being exploited and the device is non-critical.
   • DAutomatically block all traffic from the device as soon as any vulnerability is detected.
   Reveal Solution Discussion Select an answer first