ISSAP Network Security Architecture 1 — Questions and Answers
Question 1: Which network security architecture principle involves placing systems in separate security zones to limit the blast radius of a breach?
- Network segmentation (Correct answer)
- Protocol filtering
- Bandwidth throttling
- Port mirroring
Correct answer: Network segmentation
Network segmentation divides a network into isolated zones so that a compromise in one zone cannot directly spread to others, limiting the breach's blast radius.
Question 2: In a traditional three-tier network architecture, what is the primary security purpose of a DMZ (Demilitarized Zone)?
- To host internal databases securely
- To isolate publicly accessible services from the internal network (Correct answer)
- To terminate VPN connections from remote users
- To aggregate logs from all internal systems
Correct answer: To isolate publicly accessible services from the internal network
The DMZ hosts publicly accessible services (e.g., web servers) while isolating them from the internal network, so external threats cannot directly reach internal resources.
Question 3: A security architect is designing a Zero Trust network. Which of the following BEST describes the core tenet of Zero Trust?
- All internal traffic is trusted by default
- Never trust, always verify — regardless of network location (Correct answer)
- Trust is granted after a single successful authentication
- Perimeter firewalls are sufficient to enforce trust boundaries
Correct answer: Never trust, always verify — regardless of network location
Zero Trust operates on 'never trust, always verify,' requiring continuous authentication and authorization for every request regardless of where it originates.
Question 4: Where should an Intrusion Detection System (IDS) sensor be placed to detect attacks targeting a public-facing web server in a DMZ?
- Between the internal network and the DMZ firewall
- On the internal LAN segment only
- Between the external firewall and the DMZ (Correct answer)
- Behind the web server on the database segment
Correct answer: Between the external firewall and the DMZ
Placing an IDS sensor between the external firewall and the DMZ allows it to inspect inbound traffic destined for DMZ services before it reaches those servers.
Question 5: Which firewall deployment model inspects traffic based on the state of network connections and is considered more secure than simple packet filtering?
- Stateless packet filtering
- Stateful inspection firewall (Correct answer)
- Application-layer proxy
- Circuit-level gateway
Correct answer: Stateful inspection firewall
A stateful inspection firewall tracks the state of active connections and uses this context to enforce policy, blocking packets that don't belong to a known legitimate session.
Question 6: An enterprise wants to enforce consistent security policies for network access by verifying endpoint posture before granting connectivity. Which technology BEST supports this requirement?
- Network Access Control (NAC) (Correct answer)
- VPN split tunneling
- Dynamic Host Configuration Protocol (DHCP)
- Network Address Translation (NAT)
Correct answer: Network Access Control (NAC)
Network Access Control (NAC) evaluates the security posture of endpoints (patch level, antivirus status, etc.) before permitting them to connect to network segments.
Question 7: Which VPN architecture model routes all remote user traffic — including internet-bound traffic — through the corporate network for inspection?
- Split tunneling
- Full tunneling (Correct answer)
- SSL portal VPN
- Hub-and-spoke MPLS
Correct answer: Full tunneling
Full tunneling directs all remote user traffic through the corporate VPN gateway, allowing the enterprise to inspect and control all traffic including internet browsing.
ISSAP Network Security Architecture 1
Which network security architecture principle involves placing systems in separate security zones to limit the blast radius of a breach?