1.7 Identify and Describe Security Requirements and Configuration SD-WAN-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is deploying SD-WAN and wants to ensure that all traffic between sites is encrypted. They are considering using IPSec VPNs. What is a key consideration when configuring IPSec VPNs in an SD-WAN environment?

   • AIPSec VPNs provide encryption but do not authenticate the endpoints.
   • BIPSec VPNs can be configured to encrypt traffic between sites, but the performance impact must be considered.
   • CIPSec VPNs are automatically configured when SD-WAN is enabled.
   • DIPSec VPNs are only needed for internet-bound traffic, not for MPLS connections.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization wants to allow its employees to access the internet but block access to social media sites during work hours. They also want to ensure that any malware downloaded from the internet is detected and blocked. What should be configured in the SD-WAN security policy?

   • AAn SSL decryption policy to inspect encrypted traffic, without any additional filtering.
   • BA URL Filtering policy that blocks the 'social networking' category, and a Threat Prevention profile that detects and blocks malware.
   • CA security policy that allows all internet traffic and relies on the ISP to block malicious content.
   • DA QoS policy that limits bandwidth to social media sites and a NAT policy for internet access.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is deploying SD-WAN and wants to ensure that all traffic between its headquarters and a remote branch is encrypted. They are considering using IPSec VPNs but are concerned about the complexity of managing many tunnels. What is the best approach to simplify management while ensuring encryption?

   • AConfigure a single IPSec VPN tunnel between the two sites and route all traffic through it.
   • BRely on the SD-WAN's built-in encryption features without configuring IPSec VPNs.
   • CUse a dynamic routing protocol with IPSec VPNs to automatically establish tunnels between sites.
   • DUse a centralized VPN management system to configure and monitor all IPSec tunnels.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is deploying SD-WAN and wants to implement a 'defense-in-depth' security posture. They plan to use multiple security services, including threat prevention, URL filtering, and SSL decryption. However, they are concerned about the complexity of managing these services and the potential for performance bottlenecks. What is the best approach to implement these services effectively?

   • AApply security services selectively based on traffic type and risk level, using security policy rules to define which services are applied.
   • BUse a third-party security appliance in addition to the SD-WAN to handle all security services.
   • CEnable all security services on all traffic to ensure maximum protection.
   • DDisable SSL decryption to avoid performance issues and rely on threat prevention for all traffic.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An SD-WAN deployment needs to protect users from accessing malicious websites and prevent data exfiltration. The security team wants to integrate security services that inspect web traffic and block known threats. Which combination of services should be enabled on the SD-WAN security policy?

   • ASSL Decryption and QoS
   • BIPSec VPN and GRE
   • CQoS and NAT
   • DURL Filtering and Threat Prevention
   Reveal Solution Discussion Select an answer first