ISSAP Network Security Architecture 2

Question 1

Micro-segmentation in a data center environment is MOST effective at controlling which type of traffic?

Accepted Answer

East-west traffic between workloads within the data center

Answer

North-south traffic from the internet to servers

Answer

Traffic between branch offices over MPLS

Answer

Management traffic to network devices

Question 2

A security architect is leveraging Software-Defined Networking (SDN) for security. Which capability of SDN BEST enhances the security posture?

Accepted Answer

Enables centralized, programmable policy enforcement across the network

Answer

Eliminates the need for encryption on internal links

Answer

Replaces firewalls with hardware load balancers

Answer

Reduces the number of VLANs required in the network

Question 3

Which DNS security extension provides cryptographic authentication of DNS responses to prevent cache poisoning attacks?

Accepted Answer

DNSSEC

Answer

DNS over HTTPS (DoH)

Answer

Split-horizon DNS

Answer

DNS sinkholing

Question 4

An architect needs to protect BGP routing infrastructure from route hijacking. Which security control BEST addresses this threat?

Accepted Answer

Implementing Resource Public Key Infrastructure (RPKI) with Route Origin Authorization

Answer

Deploying OSPF instead of BGP

Answer

Using NAT on all edge routers

Answer

Enabling VLAN tagging on peering interfaces

Question 5

Which network security monitoring approach captures full packet data for retrospective analysis of security incidents?

Accepted Answer

Full packet capture (PCAP)

Answer

NetFlow analysis

Answer

SNMP polling

Answer

Syslog aggregation

Question 6

In a secure network architecture, which technique is used to prevent a compromised VLAN from sending tagged frames to unauthorized VLANs?

Accepted Answer

VLAN hopping prevention via disabling DTP and setting native VLANs

Answer

Implementing 802.1X port authentication only

Answer

Using private VLANs for all segments

Answer

Enabling BPDU guard on all trunk ports

Question 7

Which network architecture design pattern uses a bastion host to provide controlled administrative access to systems in a protected network segment?

Accepted Answer

Jump server (jump box)

Answer

Screened subnet

Answer

Honeynet

Answer

Proxy server