9.2 Design for Maintenance and Security Across CSP Environments NETWORK-SECURITY-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which implementation approach is commonly used for SSL decryption in a cloud environment?

   • AEnabling SSL decryption only on the management interface
   • BDeploying the firewall inline and importing the necessary certificates to perform decryption
   • CConfiguring the firewall to forward all traffic to an external decryption service
   • DUsing a load balancer to decrypt traffic before sending it to the firewall
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a primary advantage of a centralized firewall architecture in a cloud environment?

   • AProvides higher availability than decentralized architectures
   • BSimplified management and consistent policy enforcement
   • CEliminates the need for any network segmentation
   • DReduced latency for all traffic by placing firewalls closer to workloads
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is deploying a centralized firewall in AWS to inspect traffic from multiple VPCs. They want to enable SSL decryption for outbound traffic. They are concerned about the performance impact of decryption on the firewall. What is the most effective way to mitigate this performance concern?

   • AUse a firewall instance type with a higher CPU and more memory, and offload TLS session establishment to a dedicated crypto engine if supported.
   • BDisable SSL decryption for all traffic and only inspect metadata.
   • CUse a decentralized architecture to distribute the decryption load.
   • DConfigure the firewall to only decrypt traffic from specific source IPs.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is deploying a centralized firewall architecture in Azure to inspect traffic for multiple spoke VNets. They need to terminate site-to-site VPN connections from branch offices. Where should the VPN gateway be placed to ensure all branch traffic is inspected by the firewall?

   • AIn the same VNet as the firewall, with the firewall inspecting traffic between the VPN gateway and the spoke VNets.
   • BIn each spoke VNet, with the firewall inspecting traffic before it reaches the VPN gateway.
   • CIn a separate VNet with no peering to the firewall VNet.
   • DOn the firewall itself, using the firewall's public IP for VPN termination.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is deploying a decentralized firewall architecture in GCP. Each application team manages its own firewall. What is a significant security challenge with this approach?

   • AThe requirement for a central management server.
   • BHigher latency for all traffic.
   • CEnsuring consistent security policies across all firewalls.
   • DThe inability to perform SSL decryption.
   Reveal Solution Discussion Select an answer first