Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Secure Network ArchitectureSwitch
All CISSP topics

4.0 Communication and Network Security

Secure Network Architecture Practice Questions

OSI and TCP/IP layers, secure protocols, segmentation, converged protocols, and software-defined networking.

One solved question, so you can see how these are marked

A security manager is reviewing a design that places TCP reliability functions in the OSI network layer. Which correction BEST aligns the models for design discussions?

TCP operates at the OSI transport layer, while IP operates at the OSI network layer.

TCP provides transport-layer services and IP provides network-layer addressing and routing. The other mappings shift these protocols one or more layers away from their normal functions.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 9 Secure Network Architecture questions in this set

Answers and explanations appear when you work through the set above.

  1. An organization is migrating services to IPv6 and needs to notify all members of a group without relying on an IPv4-style broadcast address. Which design choice is BEST?

    • Use an IPv6 anycast address for every group member.
    • Use an IPv6 multicast address with suitable group membership controls.
    • Use an IPv6 address with a broadcast prefix.
    • Use a larger IPv6 unicast subnet and send repeated unicast packets.

  2. A company must protect browser sessions to a public web service while preserving application-level authentication and confidentiality between the browser and the service. Which control is MOST appropriate?

    • An IPsec tunnel between the user's local switch and the web server.
    • A DNSSEC signature on the web service's zone.
    • TLS on the public web service with validation of its server certificate.
    • A VLAN assigned to the web service and all client devices.

  3. A risk assessment requires confidentiality for traffic crossing an untrusted network, in addition to integrity and peer authentication. Which IPsec protocol feature BEST meets the requirement?

    • AH, because it authenticates the IP payload and encrypts the packet.
    • ESP with encryption and integrity protection enabled.
    • AH with null authentication so routing headers remain visible.
    • ESP authentication alone, because authentication provides confidentiality.

  4. An administrator must securely manage a production router across a shared network. Which option should the security manager require FIRST?

    • SSH with verified host keys and approved cryptography.
    • Telnet restricted to the administrator's source subnet.
    • SNMPv1 with a long read-only community string.
    • HTTP access limited by a standard access control list.

  5. A DNSSEC deployment is being evaluated for a customer-facing domain. What security property does DNSSEC primarily add to DNS responses?

    • Confidentiality of DNS queries from recursive resolvers.
    • Origin authentication and integrity of signed DNS data.
    • Guaranteed availability of authoritative name servers during an outage.
    • Encryption of application traffic after a hostname is resolved.

  6. A flat server network allows a compromised application server to reach database and management systems. Which redesign BEST reduces lateral movement while preserving required application flows?

    • Create additional VLANs but allow unrestricted routing between them.
    • Replace VLANs with a larger shared subnet to simplify operations.
    • Micro-segmentation with identity or workload-aware allow rules and monitoring.
    • Place every server behind the same perimeter firewall and trust internal traffic.

  7. A data center wants to carry storage traffic over an Ethernet infrastructure. Which statement BEST distinguishes the relevant converged protocols?

    • FCoE: Fibre Channel over Ethernet; iSCSI: SCSI over TCP/IP.
    • FCoE carries SCSI commands over UDP, while iSCSI requires InfiniBand switches.
    • InfiniBand is a DNS security extension, while FCoE replaces IPsec.
    • iSCSI carries Fibre Channel frames directly over Ethernet without TCP/IP.

  8. During an SDN security review, which responsibility should be protected as the highest-impact control-plane concern?

    • The forwarding devices' physical cable identification process.
    • The SDN controller's policy and flow programming API.
    • The end users' browser bookmark storage.
    • The physical color of switch ports.

  9. A business is choosing between a legacy perimeter design and a zero trust architecture for workloads distributed across data centers and cloud providers. Which principle should guide the decision MOST?

    • Treat any resource inside an enterprise-owned VLAN as trusted.
    • Establish a single encrypted tunnel between sites, then authorize workloads by tunnel membership without checking their identities.
    • Base access on verified identities, device or workload context, and least privilege, without trusting location.
    • Rely on IPv6 addressing to provide security without additional policy enforcement.