1.3 Differentiate Access to Specific Applications NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization is replacing a legacy firewall that uses IP-based rules with a Palo Alto Networks firewall. The security team wants to ensure that access to a legacy mainframe application is controlled by the application itself, not by the IP address of the mainframe. The application is not currently identified by App-ID. What is the first step the team should take?

   • AUse a rule that allows all traffic to the mainframe's subnet.
   • BCreate a custom App-ID for the legacy mainframe application.
   • CBlock all traffic to the mainframe until the vendor provides an App-ID update.
   • DCreate a rule based on the mainframe's IP address and port.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security architect is designing access control for a new cloud-based project management tool. The Zero Trust principle of least privilege must be applied. Users in the 'Project Managers' group need full access, while 'Team Members' should only have read-only access. The firewall can identify the application and integrate with the identity provider. What is the most appropriate policy design?

   • ACreate a single rule that allows both groups to access the application with the same permissions.
   • BCreate two rules: one allowing 'Project Managers' full access and another allowing 'Team Members' read-only access to the application.
   • CAllow all authenticated users to access the application and rely on the application itself to enforce permissions.
   • DAllow the 'Project Managers' group to access the application and deny all other groups.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of using user and group-based access control for applications?

   • ATo ensure that only authorized users can access specific applications based on their job responsibilities.
   • BTo improve application performance by prioritizing traffic from certain groups.
   • CTo simplify network administration by reducing the number of IP addresses.
   • DTo eliminate the need for application identification.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a key benefit of tailoring access policies to specific applications rather than to broad network segments?

   • AIt ensures that all users have access to all applications.
   • BIt reduces the number of firewall rules required.
   • CIt allows for more granular and consistent enforcement across different network locations.
   • DIt eliminates the need for user authentication.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a Zero Trust architecture, how does application-specific access control differ from traditional network-segment-based access control?

   • AIt requires a separate firewall for each application.
   • BIt allows or denies access to a specific application regardless of the underlying network path.
   • CIt uses VLANs to isolate different applications from each other.
   • DIt grants access based on the user's IP address and the destination port.
   Reveal Solution Discussion Select an answer first