9.2 Design for Maintenance and Security Across CSP Environments NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is deploying a decentralized firewall architecture in GCP, with firewalls in front of each application VPC. They need to implement SSL decryption to inspect outbound traffic from applications. What is the primary design consideration for SSL decryption in this architecture?

   • AA single centralized SSL decryption policy must be pushed to all firewalls from a central management server.
   • BEach firewall must have its own SSL decryption policy and certificate, as traffic is inspected locally.
   • CSSL decryption should be disabled in decentralized architectures because it is not supported.
   • DAll traffic must be hair-pinned to a central firewall for SSL decryption.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a cloud deployment, where is a VPN gateway typically placed to terminate VPN tunnels?

   • AIn a public subnet with a public IP address
   • BIn a management subnet with no external connectivity
   • CIn a database subnet to secure traffic to the database
   • DIn a private subnet with only a private IP address
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a recommended best practice for executing an OS upgrade on a firewall in a cloud environment?

   • APerform the upgrade during peak traffic hours to test the firewall under load.
   • BDisable all security policies before the upgrade to avoid interference.
   • CTest the upgrade in a non-production environment first and then apply it to production during a scheduled maintenance window.
   • DUpgrade directly to the latest version to reduce the number of maintenance windows.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has a centralized firewall architecture in AWS with a pair of firewalls in an active/standby configuration. They need to upgrade the OS. The standby firewall is currently out of sync with the active firewall due to a previous configuration change. What is the most appropriate action before starting the upgrade?

   • APerform a failover to the standby before the upgrade, even if it is out of sync.
   • BResolve the synchronization issue and ensure the standby is fully in sync before upgrading.
   • CUpgrade the active firewall first, then fix the sync issue on the standby.
   • DProceed with the upgrade, as the standby will sync automatically during the process.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is designing a multi-VPC architecture in AWS. They need to inspect traffic between VPCs and also terminate VPN connections from branch offices. They have a small security team and want to minimize management overhead. Which architecture is most appropriate?

   • ADecentralized, with a firewall and VPN gateway in each VPC.
   • BDecentralized, with a single VPN gateway in one VPC and firewalls in all VPCs.
   • CCentralized, with a hub VPC containing the firewall and VPN gateway.
   • DCentralized, with the firewall in a separate VPC from the VPN gateway.
   Reveal Solution Discussion Select an answer first