Lesson 5

Which statement best describes the purpose of a security zone in network design?

• Provides redundancy for power circuits

• Isolates traffic only at layer 1 of the OSI model

• Groups assets with similar trust and access requirements

• Assigns public IPv6 addresses to internal hosts

A single Ethernet switch is divided so that ports 1–12 are VLAN 20 and ports 13–24 are VLAN 30. What is the primary security benefit of this configuration?

• Extends cable length beyond 100 meters

• Creates two separate broadcast domains that must be routed to communicate

• Allows hosts to share the same MAC address

• Encrypts traffic between hosts automatically

In a three-tier enterprise LAN, access switches are most likely to connect directly to which devices?

• Core routers in the datacenter

• Endpoint workstations and VoIP phones

• ISP edge routers on the perimeter

• Public web servers in a DMZ

The term “fail-closed” for a firewall means that if the firewall software crashes, ______.

• all interfaces automatically downgrade to 10 Mbps

• traffic is blocked until service is restored

• sessions are rerouted to the Internet edge

• cached web pages continue to load

Which access-layer control prevents an attacker from unplugging a printer and gaining network access with a laptop on that port?

• Dynamic DNS update

• MAC limiting on the switch interface

• Round-robin load balancing

• Source IP affinity rules

IEEE 802.1X uses Extensible Authentication Protocol (EAP) primarily to _______.

• compress large multimedia streams

• transport user credentials between supplicant and authentication server

• assign IPv6 addresses to wireless clients

• monitor SYN flood attempts on TCP 80

A transparent firewall deployed “bump-in-the-wire” has which notable attribute?

• Requires no change to existing IP addressing scheme

• Must terminate VPN tunnels with IKEv2

• Performs NAT from IPv4 to IPv6 automatically

• Allows only inbound traffic to traverse VLAN trunks

Which protocol does IPv6 use instead of ARP for local address resolution?

• DHCPv6 Rapid Commit

• Neighbor Discovery (ND)

• Secure Shell (SSH)

• Transmission Control Protocol (TCP)

On a load balancer, the round-robin scheduling method selects the next server based on _______.

• lowest active CPU utilization

• simple rotation through the pool list

• earliest SSL certificate expiration

• geographic distance from the client

An organization wants public users to reach its web farm while hiding those servers’ real IP addresses. Which device type fulfills this requirement?

• Forward proxy

• Layer 2 switch stack

• Reverse proxy placed in the DMZ

• Out-of-band management console