ISSAP Network Security Architecture 2 — Questions and Answers
Question 1: Micro-segmentation in a data center environment is MOST effective at controlling which type of traffic?
- North-south traffic from the internet to servers
- East-west traffic between workloads within the data center (Correct answer)
- Traffic between branch offices over MPLS
- Management traffic to network devices
Correct answer: East-west traffic between workloads within the data center
Micro-segmentation applies granular policies to east-west (lateral) traffic between workloads inside the data center, preventing lateral movement by attackers.
Question 2: A security architect is leveraging Software-Defined Networking (SDN) for security. Which capability of SDN BEST enhances the security posture?
- Eliminates the need for encryption on internal links
- Enables centralized, programmable policy enforcement across the network (Correct answer)
- Replaces firewalls with hardware load balancers
- Reduces the number of VLANs required in the network
Correct answer: Enables centralized, programmable policy enforcement across the network
SDN's centralized control plane allows security policies to be programmatically defined and consistently enforced across all network devices from a single controller.
Question 3: Which DNS security extension provides cryptographic authentication of DNS responses to prevent cache poisoning attacks?
- DNSSEC (Correct answer)
- DNS over HTTPS (DoH)
- Split-horizon DNS
- DNS sinkholing
Correct answer: DNSSEC
DNSSEC adds digital signatures to DNS records, allowing resolvers to verify the authenticity and integrity of DNS responses and prevent cache poisoning.
Question 4: An architect needs to protect BGP routing infrastructure from route hijacking. Which security control BEST addresses this threat?
- Deploying OSPF instead of BGP
- Implementing Resource Public Key Infrastructure (RPKI) with Route Origin Authorization (Correct answer)
- Using NAT on all edge routers
- Enabling VLAN tagging on peering interfaces
Correct answer: Implementing Resource Public Key Infrastructure (RPKI) with Route Origin Authorization
RPKI with Route Origin Authorization (ROA) cryptographically validates that BGP route announcements originate from authorized Autonomous Systems, mitigating route hijacking.
Question 5: Which network security monitoring approach captures full packet data for retrospective analysis of security incidents?
- NetFlow analysis
- Full packet capture (PCAP) (Correct answer)
- SNMP polling
- Syslog aggregation
Correct answer: Full packet capture (PCAP)
Full packet capture (PCAP) records the complete contents of network packets, enabling security analysts to reconstruct sessions and perform detailed forensic analysis after an incident.
Question 6: In a secure network architecture, which technique is used to prevent a compromised VLAN from sending tagged frames to unauthorized VLANs?
- VLAN hopping prevention via disabling DTP and setting native VLANs (Correct answer)
- Implementing 802.1X port authentication only
- Using private VLANs for all segments
- Enabling BPDU guard on all trunk ports
Correct answer: VLAN hopping prevention via disabling DTP and setting native VLANs
Disabling Dynamic Trunking Protocol (DTP) and configuring a dedicated, unused native VLAN prevents double-tagging and switch spoofing attacks that enable VLAN hopping.
Question 7: Which network architecture design pattern uses a bastion host to provide controlled administrative access to systems in a protected network segment?
- Screened subnet
- Jump server (jump box) (Correct answer)
- Honeynet
- Proxy server
Correct answer: Jump server (jump box)
A jump server (jump box) is a hardened, monitored bastion host that administrators must connect through to reach systems in restricted segments, providing an audited single point of entry.
ISSAP Network Security Architecture 2
Micro-segmentation in a data center environment is MOST effective at controlling which type of traffic?