6.1 Explain the Configuration and Maintenance of Network Security for On-Premises, Cloud, and Hybrid Networks (e.g., Network Segmentation, Policies, Monitoring and Logging, Certificates) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of network segmentation in a hybrid network environment?

   • ATo increase the available bandwidth for all network traffic
   • BTo simplify the network by using a single flat network for all devices
   • CTo eliminate the need for firewalls and other security devices
   • DTo isolate traffic and enforce security boundaries between different network zones
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company runs a web application on an Azure App Service that is fronted by a Palo Alto Networks firewall (PA-VM) in a hub VNet. The application uses a custom domain. The security team wants to ensure that client-to-firewall and firewall-to-App Service traffic is encrypted. Which certificate-related configuration is required?

   • AInstall a certificate on the firewall for the custom domain, and bind a certificate to the App Service for the same domain.
   • BConfigure the firewall to use a self-signed certificate for the client-facing side, and rely on Azure's default App Service certificate for the backend.
   • CUse the same certificate for both the firewall and the App Service, but only if it is a wildcard certificate.
   • DInstall a certificate only on the App Service, because the firewall can pass through TLS without terminating it.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company uses a Palo Alto Networks firewall for SSL decryption. The firewall's decryption certificate is about to expire, and the administrator needs to replace it without causing downtime for users. Which approach should be used?

   • AGenerate a new certificate, import it into the firewall, and update the SSL decryption profile to use the new certificate during a maintenance window.
   • BDisable SSL decryption temporarily, then re-enable it with the new certificate; users will not notice any change.
   • CUse the same certificate on the firewall and the internal CA, and the firewall will automatically renew it.
   • DWait until the certificate expires, then import the new certificate; the firewall will automatically apply it.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a key reason for regularly renewing certificates before they expire?

   • ATo ensure continuous secure communications without service interruptions
   • BTo increase the encryption strength of the certificate
   • CTo change the certificate authority for better trust
   • DTo reduce the cost of the certificate
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is deploying a three-tier application in a single Azure virtual network. The web tier must be reachable from the internet, the application tier must only be reachable from the web tier, and the database tier must only be reachable from the application tier. The security team wants to enforce these boundaries using Azure network security groups (NSGs). Which configuration should you implement?

   • APlace all VMs in the same subnet and rely on application-level authentication to restrict access between tiers, without using NSGs.
   • BCreate a separate subnet for each tier, apply a distinct NSG to each subnet, and configure rules that allow only the required inbound traffic from the previous tier.
   • CApply one NSG to the entire subnet and use priority-ordered rules to allow web-to-app and app-to-db traffic, with a default deny for all other traffic.
   • DUse a single NSG applied to each VM's NIC, with rules that allow all traffic within the virtual network and deny only inbound internet traffic.
   Reveal Solution Discussion Select an answer first