3 Security Architecture and Network Design Online Quiz Questions

True

False

Place production, development, and test workloads on one unrestricted network for convenience.

Separate production, development, and test environments and control communication between them.

Allow all test systems to access production data and administrative interfaces by default.

Use separate cloud accounts but permit unrestricted traffic between all workloads.

True

False

Place the web server on the database network and allow internet users to connect to both systems.

Place the web server in a DMZ, allow only its required connection to an internal application service, and deny direct internet access to the database.

Allow the web server to reach every internal system so it can support future features.

Place the database in the DMZ and allow the web server and internet users unrestricted access to it.

Grant access to the entire internal network whenever a device has a corporate IP address.

Trust any managed device automatically, without verifying its user or security state.

Verify the user and device, consider relevant context, and grant access to the specific application required.

Grant unrestricted access after a user connects through the corporate VPN.

Permit only the required source, destination, protocol, and port for a documented purpose.

Allow all traffic between internal zones because the systems are owned by the same organization.

Deny other traffic by default where feasible and review rules to remove obsolete exceptions.

Allow any source to connect to any destination as long as the protocol is approved.

Restrict inbound administrative traffic to the sources and services that are required.

Allow all sources to reach administrative ports so administrators can connect from anywhere.

Protect management interfaces and APIs, log their use, and monitor configuration changes.

Assume the cloud provider is responsible for every security setting, including customer access permissions.

Use two network paths that depend on the same power source and router.

Use alternate paths that do not share a single failure point capable of disabling both.

Add a second service instance but connect both instances through the same sole network link.

Duplicate hardware without checking for shared infrastructure dependencies.

It determines which firewall rules can be removed without review.

It proves that completed backup jobs can be restored successfully.

It identifies critical services and helps prioritize recovery requirements.

It replaces the need to define recovery strategies.

Place the web server on the database network and allow it to connect to any internal host.

Place the web server in a DMZ, permit only its required connection to an internal application service, and deny direct internet access to the database.

Allow internet users to connect to the database, but require the web server to use a VPN.

Place the web server and database in the DMZ and rely on their separate hostnames to limit access.

Allow every internal device to reach the database, but block internet hosts.

Allow user workstations to reach the database on any port, but limit application servers to one port.

Allow the application server to reach the database on its required service port, and block direct database connections from user workstations and internet hosts.

Allow all traffic between internal network segments, and rely on VLANs to restrict database access.

Verify the user and managed device, then grant access to the specific application required.

Grant access to the entire internal network because the employee passed MFA.

Trust the employee's device because it is organization-owned, and check identity only at login.

Allow unrestricted access to internal resources after the employee connects through the VPN.

True

False