Question 160 Two business units share one VLAN and cross-unit broadcast access violates isolation requirements. What should change? Protect controller APIs using least-privilege authorization, strong authentication and audit Move workloads into distinct logical segments with enforced inter-segment policy Use dedicated identity and privileged-access controls for administration rather than content delivery Require authorized network admission and role-appropriate access beyond link encryption Explanation Correct Answer B:VLAN separation is useful only when routed or firewall paths also enforce the intended trust boundary. Incorrect Answers A:For the separate situation in which an SDN controller API can change routing across every tenant without strong access control, a centralized control plane has broad blast radius if management access is compromised; here the stated problem requires move workloads into distinct logical segments with enforced inter-segment policy. C:This option fits a different fact pattern where a developer suggests using a CDN to authenticate private database administrators: a CDN optimizes distribution but does not replace administrative authentication and authorization; the current case instead requires move workloads into distinct logical segments with enforced inter-segment policy. D:The other scenario states that a research lab encrypts Wi-Fi but allows any employee to join a sensitive test network, where encryption of radio frames alone does not establish need-to-know for the service network; by contrast, the present case requires move workloads into distinct logical segments with enforced inter-segment policy.
Question 161 A manufacturing plant permits unrestricted traffic from office laptops to programmable controllers. What architecture reduces exposure? Measure and control packet jitter, latency and loss for real-time traffic Separate an authenticated management plane from general user traffic Create industrial security zones and tightly governed conduits between corporate and OT networks Mutually authenticate endpoints and encrypt model traffic across network trust boundaries Explanation Correct Answer C:Explicit segmentation constrains malware spread and protects safety-critical control traffic. Incorrect Answers A:For the separate situation in which a voice service suffers choppy calls despite ample average bandwidth, voice quality depends on delay variation and loss, not merely peak bandwidth; here the stated problem requires create industrial security zones and tightly governed conduits between corporate and OT networks. B:Out-of-band or restricted management limits lateral access to high-privilege device interfaces; it is relevant where a bank routes server administration through the same open employee Wi-Fi as web browsing, whereas the current facts require create industrial security zones and tightly governed conduits between corporate and OT networks to address the stated problem. D:Large AI datasets still require authenticated transport and confidentiality on untrusted links; it is relevant where a distributed learning cluster sends private model inputs to public edge nodes without transport authentication, whereas the current facts require create industrial security zones and tightly governed conduits between corporate and OT networks to address the stated problem.
Question 162 A zero-trust deployment assumes users on an internal VPN may access every workload. What should be corrected? Apply capacity planning and quality-of-service policy or separate replication paths Perform per-resource authorization using device and identity context rather than VPN location alone Define explicit destination and service allowlists with monitored exceptions Move workloads into distinct logical segments with enforced inter-segment policy Explanation Correct Answer B:Network access is not equivalent to application authorization in a zero-trust model. Incorrect Answers A:Availability needs predictable contention management for competing traffic classes; it is relevant where a data center uses one path for both production and backup replication, causing recovery traffic to starve transactions, whereas the current facts require perform per-resource authorization using device and identity context rather than VPN location alone to address the stated problem. C:This option fits a different fact pattern where a firewall allows outbound connections to every port from a sensitive data processing enclave: least-privilege egress reduces external command-and-control and unapproved data movement; the current case instead requires perform per-resource authorization using device and identity context rather than VPN location alone. D:The other scenario states that two business units share one VLAN and cross-unit broadcast access violates isolation requirements, where vLAN separation is useful only when routed or firewall paths also enforce the intended trust boundary; by contrast, the present case requires perform per-resource authorization using device and identity context rather than VPN location alone.
Question 163 A service requires a point-to-point encrypted tunnel across an untrusted IP carrier. Which protocol family fits? Measure and control packet jitter, latency and loss for real-time traffic Use a supported IPsec tunnel with authenticated peers and modern cryptographic proposals Use controlled resolver egress, approved forwarding and monitored DNS filtering Place IoT endpoints in a separately controlled segment with explicit allowed egress Explanation Correct Answer B:IPsec can protect network-layer packet transport between trusted endpoints over hostile transit. Incorrect Answers A:Voice quality depends on delay variation and loss, not merely peak bandwidth; this responds to the different circumstance in which a voice service suffers choppy calls despite ample average bandwidth, while the current case states that a service requires a point-to-point encrypted tunnel across an untrusted IP carrier, calling for use a supported IPsec tunnel with authenticated peers and modern cryptographic proposals. C:DNS can become a bypass or exfiltration path unless resolver traffic is governed; this responds to the different circumstance in which a DNS architecture sends recursive resolvers directly to arbitrary Internet name servers without policy, while the current case states that a service requires a point-to-point encrypted tunnel across an untrusted IP carrier, calling for use a supported IPsec tunnel with authenticated peers and modern cryptographic proposals. D:Device category and trustworthiness should drive zone placement and traffic policy; it is relevant where an enterprise wants to prevent an untrusted IoT device from entering the employee production segment, whereas the current facts require use a supported IPsec tunnel with authenticated peers and modern cryptographic proposals to address the stated problem.
Question 164 An architect places a legacy plaintext protocol inside a VLAN and claims confidentiality is achieved. What is the missing control? Mutually authenticate endpoints and encrypt model traffic across network trust boundaries Encrypt the communication channel because VLAN tagging is not cryptographic protection Add independent authenticated encryption and authorization where confidentiality is required Use dedicated identity and privileged-access controls for administration rather than content delivery Explanation Correct Answer B:Logical separation alone cannot prevent disclosure to an adversary on the path. Incorrect Answers A:For the separate situation in which a distributed learning cluster sends private model inputs to public edge nodes without transport authentication, large AI datasets still require authenticated transport and confidentiality on untrusted links; here the stated problem requires encrypt the communication channel because VLAN tagging is not cryptographic protection. C:Encapsulation supplies virtual-network transport, not confidentiality by itself; although this helps when a cloud overlay uses VXLAN but treats encapsulation as protection from packet observers, it leaves the current case's need to encrypt the communication channel because VLAN tagging is not cryptographic protection unresolved. D:A CDN optimizes distribution but does not replace administrative authentication and authorization; this responds to the different circumstance in which a developer suggests using a CDN to authenticate private database administrators, while the current case states that an architect places a legacy plaintext protocol inside a VLAN and claims confidentiality is achieved, calling for encrypt the communication channel because VLAN tagging is not cryptographic protection.
Question 165 A voice service suffers choppy calls despite ample average bandwidth. What network property should engineers investigate? Measure and control packet jitter, latency and loss for real-time traffic Place the database in isolated network segments with narrowly authorized application paths Add independent authenticated encryption and authorization where confidentiality is required Define explicit destination and service allowlists with monitored exceptions Explanation Correct Answer A:Voice quality depends on delay variation and loss, not merely peak bandwidth. Incorrect Answers B:For the separate situation in which a cloud workload accepts web traffic but must not permit direct Internet connections to its database, segmentation reduces attack reachability to data services beyond endpoint authentication alone; here the stated problem requires measure and control packet jitter, latency and loss for real-time traffic. C:Encapsulation supplies virtual-network transport, not confidentiality by itself; this responds to the different circumstance in which a cloud overlay uses VXLAN but treats encapsulation as protection from packet observers, while the current case states that a voice service suffers choppy calls despite ample average bandwidth, calling for measure and control packet jitter, latency and loss for real-time traffic. D:The other scenario states that a firewall allows outbound connections to every port from a sensitive data processing enclave, where least-privilege egress reduces external command-and-control and unapproved data movement; by contrast, the present case requires measure and control packet jitter, latency and loss for real-time traffic.
Question 166 A DNS architecture sends recursive resolvers directly to arbitrary Internet name servers without policy. What should be introduced? Publish narrowly scoped service-level connectivity rather than a broad site-to-site network route Use controlled resolver egress, approved forwarding and monitored DNS filtering Move workloads into distinct logical segments with enforced inter-segment policy Place the database in isolated network segments with narrowly authorized application paths Explanation Correct Answer B:DNS can become a bypass or exfiltration path unless resolver traffic is governed. Incorrect Answers A:Service-specific exposure limits lateral movement and simplifies partner authorization; this responds to the different circumstance in which a partner must access one private API but not the enterprise's whole routed subnet range, while the current case states that a DNS architecture sends recursive resolvers directly to arbitrary Internet name servers without policy, calling for use controlled resolver egress, approved forwarding and monitored DNS filtering. C:This option fits a different fact pattern where two business units share one VLAN and cross-unit broadcast access violates isolation requirements: vLAN separation is useful only when routed or firewall paths also enforce the intended trust boundary; the current case instead requires use controlled resolver egress, approved forwarding and monitored DNS filtering. D:The other scenario states that a cloud workload accepts web traffic but must not permit direct Internet connections to its database, where segmentation reduces attack reachability to data services beyond endpoint authentication alone; by contrast, the present case requires use controlled resolver egress, approved forwarding and monitored DNS filtering.
Question 167 An SDN controller API can change routing across every tenant without strong access control. What should the design require? Implement equivalent IPv6 routing, filtering and observability policies Protect controller APIs using least-privilege authorization, strong authentication and audit Define explicit destination and service allowlists with monitored exceptions Mutually authenticate endpoints and encrypt model traffic across network trust boundaries Explanation Correct Answer B:A centralized control plane has broad blast radius if management access is compromised. Incorrect Answers A:Dual-stack deployments introduce separate address and control surfaces that must be governed; it is relevant where a business sends sensitive IPv6 traffic but monitors only IPv4 firewall rules, whereas the current facts require protect controller APIs using least-privilege authorization, strong authentication and audit to address the stated problem. C:This option fits a different fact pattern where a firewall allows outbound connections to every port from a sensitive data processing enclave: least-privilege egress reduces external command-and-control and unapproved data movement; the current case instead requires protect controller APIs using least-privilege authorization, strong authentication and audit. D:Large AI datasets still require authenticated transport and confidentiality on untrusted links; this responds to the different circumstance in which a distributed learning cluster sends private model inputs to public edge nodes without transport authentication, while the current case states that an SDN controller API can change routing across every tenant without strong access control, calling for protect controller APIs using least-privilege authorization, strong authentication and audit.
Question 168 A microservice cluster allows unlimited east-west calls between unrelated services. What reduces lateral movement? Apply identity-aware microsegmentation for approved service-to-service flows Collect network flow and dependency evidence to build an accurate application communication map Measure and control packet jitter, latency and loss for real-time traffic Create industrial security zones and tightly governed conduits between corporate and OT networks Explanation Correct Answer A:Distributed enforcement limits internal reachability even after one service is compromised. Incorrect Answers B:This option fits a different fact pattern where a company wants to identify hidden internal east-west connections before defining segmentation: control design depends on real service dependencies, not assumed VLAN membership; the current case instead requires apply identity-aware microsegmentation for approved service-to-service flows. C:Voice quality depends on delay variation and loss, not merely peak bandwidth; it is relevant where a voice service suffers choppy calls despite ample average bandwidth, whereas the current facts require apply identity-aware microsegmentation for approved service-to-service flows to address the stated problem. D:Explicit segmentation constrains malware spread and protects safety-critical control traffic; although this helps when a manufacturing plant permits unrestricted traffic from office laptops to programmable controllers, it leaves the current case's need to apply identity-aware microsegmentation for approved service-to-service flows unresolved.
Question 169 A business sends sensitive IPv6 traffic but monitors only IPv4 firewall rules. What is the primary architecture gap? Publish narrowly scoped service-level connectivity rather than a broad site-to-site network route Implement equivalent IPv6 routing, filtering and observability policies Mutually authenticate endpoints and encrypt model traffic across network trust boundaries Define explicit destination and service allowlists with monitored exceptions Explanation Correct Answer B:Dual-stack deployments introduce separate address and control surfaces that must be governed. Incorrect Answers A:Service-specific exposure limits lateral movement and simplifies partner authorization; it is relevant where a partner must access one private API but not the enterprise's whole routed subnet range, whereas the current facts require implement equivalent IPv6 routing, filtering and observability policies to address the stated problem. C:This option fits a different fact pattern where a distributed learning cluster sends private model inputs to public edge nodes without transport authentication: large AI datasets still require authenticated transport and confidentiality on untrusted links; the current case instead requires implement equivalent IPv6 routing, filtering and observability policies. D:Least-privilege egress reduces external command-and-control and unapproved data movement; although this helps when a firewall allows outbound connections to every port from a sensitive data processing enclave, it leaves the current case's need to implement equivalent IPv6 routing, filtering and observability policies unresolved.
Question 170 An enterprise wants to prevent an untrusted IoT device from entering the employee production segment. What network design works? Perform per-resource authorization using device and identity context rather than VPN location alone Place IoT endpoints in a separately controlled segment with explicit allowed egress Require authorized network admission and role-appropriate access beyond link encryption Engineer independently routed paths and verify failure detection and convergence Explanation Correct Answer B:Device category and trustworthiness should drive zone placement and traffic policy. Incorrect Answers A:This option fits a different fact pattern where a zero-trust deployment assumes users on an internal VPN may access every workload: network access is not equivalent to application authorization in a zero-trust model; the current case instead requires place IoT endpoints in a separately controlled segment with explicit allowed egress. C:Encryption of radio frames alone does not establish need-to-know for the service network; although this helps when a research lab encrypts Wi-Fi but allows any employee to join a sensitive test network, it leaves the current case's need to place IoT endpoints in a separately controlled segment with explicit allowed egress unresolved. D:A single carrier or edge dependency can defeat internal equipment redundancy; it is relevant where an enterprise depends entirely on one network path through a provider edge for critical communications, whereas the current facts require place IoT endpoints in a separately controlled segment with explicit allowed egress to address the stated problem.
