01
Choose one
1 point
A web application must receive public requests while keeping its application service off the public internet. Which traffic policy best supports this design?
Free Practice Quiz Question List
4 Network Segmentation and Isolation Online Quiz Questions
Use this free practice quiz with 20 questions to review 4 Network Segmentation and Isolation, test your knowledge, and prepare for your next test or exam.
20 questions
02
True or false
1 point
A zero-trust design should grant a service access to a resource solely because both are in the same network zone.
- A
True
- B
False
03
Fill in the blank
1 point
When documenting an allowed flow across a zone boundary, record its source, destination, service or port, direction, and .
04
Written response
1 point
What traffic-handling property of AWS security groups means that return traffic for an allowed connection is handled automatically?
05
Choose one
1 point
A team is deciding how to divide its systems into security zones. Which approach best supports effective segmentation?
- A
Group systems only by physical location, even when their purposes and sensitivity differ.
- B
Group systems according to resource sensitivity, purpose, and required access.
- C
Put every system that shares an IP range into one trusted zone.
06
Choose all
1 point
Select all practices that support a restrictive, reviewable traffic policy between security zones.
- A
Begin with denial and permit only documented flows required for business or system functions.
- B
Avoid broad rules that allow all traffic from the internal network.
- C
Allow every flow between zones unless an incident proves it is unsafe.
- D
Permit all outbound traffic because only inbound paths affect security.
07
Fill in the blank
1 point
To restrict outbound traffic, a workload might be allowed to contact required services such as approved APIs, , or update repositories.
08
True or false
1 point
True or false: AWS network ACLs are stateless, so their rules must explicitly account for return traffic.
- A
True
- B
False
09
Choose all
1 point
Select all approaches that can help control service-to-service communication without relying solely on subnet membership.
- A
Use network rules to limit which workloads can reach a destination.
- B
Use application-aware controls to verify service identity and authorize specific operations.
- C
Share one broad credential among services so they can access each other's resources.
- D
Treat services as authorized whenever they share a subnet.
10
Choose one
1 point
Two services share a subnet, but one needs to read selected records from the other's data store. What is the best basis for allowing that access?
- A
Allow access automatically because the services share a subnet.
- B
Allow access if the requesting service has any valid identity, regardless of the requested resource.
- C
Authenticate the requesting service and authorize it for the specific resource and operation.
- D
Give the service administrator-level access so it can handle future requests.
11
Written response
1 point
In the example application layout, what is the name of the zone for databases and other stores containing sensitive information?
12
Choose one
1 point
A team needs to enforce access decisions on application requests as they pass between services. Which enforcement point is best suited to authenticate and authorize those requests?
- A
Use only subnet controls because they can verify every application operation.
- B
Use a gateway or proxy to authenticate and authorize application requests.
- C
Allow requests from any host that can route to the application.
- D
Rely only on physical separation between the gateway and application.
13
Open ended
1 point
A company is deploying a public application with an application service and a database containing sensitive records. Propose a segmentation and access-control design that limits unnecessary paths while still allowing the application to function. Include how the team should validate and maintain the design.
14
True or false
1 point
True or false: Security zones should be defined only by physical location or IP range.
- A
True
- B
False
15
Choose one
1 point
A company is planning zones for an application with public-facing components, services that process requests, sensitive data stores, and administrative tools. Which approach should guide the zone boundaries?
- A
Group systems by physical location, using the same access policy for every system in each location.
- B
Group resources according to their sensitivity, purpose, and required access.
- C
Place systems with similar IP addresses together, regardless of what they do.
- D
Put every system used by the same department in one zone, regardless of its sensitivity.
16
Choose one
1 point
A team is documenting allowed traffic across a boundary between two security zones. Which set of details provides the complete basis for a specific traffic rule?
- A
Specify the source, destination, service or port, direction, and reason for each allowed flow.
- B
Specify the source and destination, then allow all traffic between them in both directions.
- C
Specify the service and purpose, but leave the source and destination to be inferred from the network.
- D
Specify the destination and direction, then allow any service from internal systems.
17
Choose one
1 point
A service uses an ingress gateway, an application service, and a database. The policy already permits necessary gateway-to-application and application-to-database flows. Which additional flow conflicts with the intended design?
- A
Allow the application service to initiate connections to the database on its required database port.
- B
Allow the ingress gateway to forward approved requests to the application service on its required port.
- C
Allow internet clients to initiate connections directly to the database on its required database port.
- D
Allow authorized operators to reach the database using approved administrative protocols.
18
Written response
1 point
An AWS network ACL allows an incoming request, but its response is blocked unless a separate return-traffic rule is added. What network property explains this behavior?
19
Choose one
1 point
A reporting service needs to display selected database records and does not need to change them. Which permission design best limits its access?
- A
Give the reporting service the same permissions as the application service so it can handle future tasks.
- B
Allow the reporting service to modify all database records, but only during business hours.
- C
Share an administrator credential with the reporting service so its access can be managed centrally.
- D
Allow the reporting service to read only the selected records it needs.
20
Written response
1 point
During routine validation of a segmented environment, observed network traffic is compared with what documented reference?