8.4 Evaluate and Design to Device-ID Capabilities NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A retail chain is deploying Device-ID across 50 stores. Each store has a local firewall and a central DHCP server at the headquarters. The network team wants to enforce device-based policies for point-of-sale (POS) terminals. They are concerned about the delay in device identification because the DHCP logs must be sent from the central server to each firewall. What is the best design to reduce this delay?

   • ADeploy a local DHCP server at each store to provide immediate IP-to-MAC mapping to the local firewall.
   • BUse traffic fingerprinting as the primary data source for device identification.
   • CConfigure the firewall to use the central DHCP server's logs but increase the polling interval.
   • DUse Active Directory to identify POS terminals.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A hospital is deploying Device-ID to enforce a policy that allows only authorized medical IoT devices (e.g., infusion pumps, patient monitors) to communicate with the clinical network. The network has both wired and wireless segments, and DHCP is used for IP assignment. The security team wants to ensure that devices are correctly identified even when they roam between access points. Which combination of data sources should the architect rely on as the primary mapping mechanism?

   • ADHCP snooping and Active Directory
   • BDHCP snooping and device fingerprinting from traffic
   • CUser-ID agent and DHCP snooping
   • DDHCP logs and network traffic analysis
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is deploying Device-ID in an environment where some devices use static IP addresses and others use DHCP. The security team wants to ensure that all devices are identified. Which data sources should the architect use?

   • ADHCP logs and Active Directory
   • BTraffic fingerprinting and User-ID agent
   • CActive Directory and User-ID agent
   • DDHCP logs and traffic fingerprinting
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A large enterprise is deploying Device-ID across multiple sites. The network uses a mix of wired and wireless access, and there is a central DHCP server that assigns IP addresses from a single pool. The security team wants to enforce device-based policies at the firewall. They are concerned about the scalability of Device-ID in a high-availability (HA) pair. Which design consideration is most important to ensure Device-ID works correctly in this environment?

   • AEnsure that both firewalls in the HA pair have the same Device-ID configuration and that the device mapping table is synchronized.
   • BConfigure the firewall to use only DHCP logs as the data source to avoid overloading the device mapping table.
   • CUse a separate Device-ID collector to offload the mapping process from the firewall.
   • DPlace the firewall in inline mode to inspect all traffic and generate Device-ID mappings from the data path.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which method is commonly used to monitor the effectiveness of Device-ID?

   • AEnsuring that User-ID is disabled
   • BVerifying that all devices have static IP addresses
   • CReviewing Device-ID logs for unknown or misclassified devices
   • DChecking the firewall's CPU utilization
   Reveal Solution Discussion Select an answer first