Question 170 An enterprise wants to prevent an untrusted IoT device from entering the employee production segment. What network design works? Perform per-resource authorization using device and identity context rather than VPN location alone Place IoT endpoints in a separately controlled segment with explicit allowed egress Require authorized network admission and role-appropriate access beyond link encryption Engineer independently routed paths and verify failure detection and convergence Explanation Correct Answer B:Device category and trustworthiness should drive zone placement and traffic policy. Incorrect Answers A:This option fits a different fact pattern where a zero-trust deployment assumes users on an internal VPN may access every workload: network access is not equivalent to application authorization in a zero-trust model; the current case instead requires place IoT endpoints in a separately controlled segment with explicit allowed egress. C:Encryption of radio frames alone does not establish need-to-know for the service network; although this helps when a research lab encrypts Wi-Fi but allows any employee to join a sensitive test network, it leaves the current case's need to place IoT endpoints in a separately controlled segment with explicit allowed egress unresolved. D:A single carrier or edge dependency can defeat internal equipment redundancy; it is relevant where an enterprise depends entirely on one network path through a provider edge for critical communications, whereas the current facts require place IoT endpoints in a separately controlled segment with explicit allowed egress to address the stated problem.
Question 171 A developer suggests using a CDN to authenticate private database administrators. Which design boundary is being confused? Use dedicated identity and privileged-access controls for administration rather than content delivery Add independent authenticated encryption and authorization where confidentiality is required Restrict management-plane reachability and authenticate administrative sessions independently Protect controller APIs using least-privilege authorization, strong authentication and audit Explanation Correct Answer A:A CDN optimizes distribution but does not replace administrative authentication and authorization. Incorrect Answers B:Encapsulation supplies virtual-network transport, not confidentiality by itself; although this helps when a cloud overlay uses VXLAN but treats encapsulation as protection from packet observers, it leaves the current case's need to use dedicated identity and privileged-access controls for administration rather than content delivery unresolved. C:Separating management reduces the exposure of high-impact control functions; although this helps when a branch router's management interface is accessible on the public data plane, it leaves the current case's need to use dedicated identity and privileged-access controls for administration rather than content delivery unresolved. D:For the separate situation in which an SDN controller API can change routing across every tenant without strong access control, a centralized control plane has broad blast radius if management access is compromised; here the stated problem requires use dedicated identity and privileged-access controls for administration rather than content delivery.
Question 172 A partner must access one private API but not the enterprise's whole routed subnet range. What connectivity architecture best reduces trust? Measure and control packet jitter, latency and loss for real-time traffic Engineer independently routed paths and verify failure detection and convergence Publish narrowly scoped service-level connectivity rather than a broad site-to-site network route Create industrial security zones and tightly governed conduits between corporate and OT networks Explanation Correct Answer C:Service-specific exposure limits lateral movement and simplifies partner authorization. Incorrect Answers A:Voice quality depends on delay variation and loss, not merely peak bandwidth; although this helps when a voice service suffers choppy calls despite ample average bandwidth, it leaves the current case's need to publish narrowly scoped service-level connectivity rather than a broad site-to-site network route unresolved. B:A single carrier or edge dependency can defeat internal equipment redundancy; it is relevant where an enterprise depends entirely on one network path through a provider edge for critical communications, whereas the current facts require publish narrowly scoped service-level connectivity rather than a broad site-to-site network route to address the stated problem. D:Explicit segmentation constrains malware spread and protects safety-critical control traffic; this responds to the different circumstance in which a manufacturing plant permits unrestricted traffic from office laptops to programmable controllers, while the current case states that a partner must access one private API but not the enterprise's whole routed subnet range, calling for publish narrowly scoped service-level connectivity rather than a broad site-to-site network route.
Question 173 An organization uses a single flat network for guest Wi-Fi and internal resources. What should the network team establish? Perform per-resource authorization using device and identity context rather than VPN location alone Add independent authenticated encryption and authorization where confidentiality is required Require supported TLS versions and validated certificate-based server authentication Isolate guests with dedicated network and enforced Internet-only policy Explanation Correct Answer D:Guest connectivity must not inherit internal trust simply by sharing physical access points. Incorrect Answers A:This option fits a different fact pattern where a zero-trust deployment assumes users on an internal VPN may access every workload: network access is not equivalent to application authorization in a zero-trust model; the current case instead requires isolate guests with dedicated network and enforced Internet-only policy. B:Encapsulation supplies virtual-network transport, not confidentiality by itself; this responds to the different circumstance in which a cloud overlay uses VXLAN but treats encapsulation as protection from packet observers, while the current case states that an organization uses a single flat network for guest Wi-Fi and internal resources, calling for isolate guests with dedicated network and enforced Internet-only policy. C:Secure transport depends on current protocol configuration and identity validation; although this helps when a public API uses obsolete SSL negotiation even though clients support modern TLS, it leaves the current case's need to isolate guests with dedicated network and enforced Internet-only policy unresolved.
Question 174 A research lab encrypts Wi-Fi but allows any employee to join a sensitive test network. What is missing? Define explicit destination and service allowlists with monitored exceptions Require authorized network admission and role-appropriate access beyond link encryption Separate an authenticated management plane from general user traffic Encrypt the communication channel because VLAN tagging is not cryptographic protection Explanation Correct Answer B:Encryption of radio frames alone does not establish need-to-know for the service network. Incorrect Answers A:The other scenario states that a firewall allows outbound connections to every port from a sensitive data processing enclave, where least-privilege egress reduces external command-and-control and unapproved data movement; by contrast, the present case requires require authorized network admission and role-appropriate access beyond link encryption. C:For the separate situation in which a bank routes server administration through the same open employee Wi-Fi as web browsing, out-of-band or restricted management limits lateral access to high-privilege device interfaces; here the stated problem requires require authorized network admission and role-appropriate access beyond link encryption. D:Logical separation alone cannot prevent disclosure to an adversary on the path; although this helps when an architect places a legacy plaintext protocol inside a VLAN and claims confidentiality is achieved, it leaves the current case's need to require authorized network admission and role-appropriate access beyond link encryption unresolved.
Question 175 A satellite connection has very high round-trip delay, harming an interactive application. What should the design address? Implement equivalent IPv6 routing, filtering and observability policies Place IoT endpoints in a separately controlled segment with explicit allowed egress Assess latency-sensitive protocols and use buffering or alternative paths where viable Require supported TLS versions and validated certificate-based server authentication Explanation Correct Answer C:Throughput capacity cannot remove the effects of propagation delay on request-response workflows. Incorrect Answers A:For the separate situation in which a business sends sensitive IPv6 traffic but monitors only IPv4 firewall rules, dual-stack deployments introduce separate address and control surfaces that must be governed; here the stated problem requires assess latency-sensitive protocols and use buffering or alternative paths where viable. B:The other scenario states that an enterprise wants to prevent an untrusted IoT device from entering the employee production segment, where device category and trustworthiness should drive zone placement and traffic policy; by contrast, the present case requires assess latency-sensitive protocols and use buffering or alternative paths where viable. D:Secure transport depends on current protocol configuration and identity validation; although this helps when a public API uses obsolete SSL negotiation even though clients support modern TLS, it leaves the current case's need to assess latency-sensitive protocols and use buffering or alternative paths where viable unresolved.
Question 176 A cloud overlay uses VXLAN but treats encapsulation as protection from packet observers. What correction is required? Place the database in isolated network segments with narrowly authorized application paths Require supported TLS versions and validated certificate-based server authentication Move workloads into distinct logical segments with enforced inter-segment policy Add independent authenticated encryption and authorization where confidentiality is required Explanation Correct Answer D:Encapsulation supplies virtual-network transport, not confidentiality by itself. Incorrect Answers A:Segmentation reduces attack reachability to data services beyond endpoint authentication alone; this responds to the different circumstance in which a cloud workload accepts web traffic but must not permit direct Internet connections to its database, while the current case states that a cloud overlay uses VXLAN but treats encapsulation as protection from packet observers, calling for add independent authenticated encryption and authorization where confidentiality is required. B:This option fits a different fact pattern where a public API uses obsolete SSL negotiation even though clients support modern TLS: secure transport depends on current protocol configuration and identity validation; the current case instead requires add independent authenticated encryption and authorization where confidentiality is required. C:VLAN separation is useful only when routed or firewall paths also enforce the intended trust boundary; although this helps when two business units share one VLAN and cross-unit broadcast access violates isolation requirements, it leaves the current case's need to add independent authenticated encryption and authorization where confidentiality is required unresolved.
Question 177 A branch router's management interface is accessible on the public data plane. What should architects change? Restrict management-plane reachability and authenticate administrative sessions independently Move workloads into distinct logical segments with enforced inter-segment policy Use controlled resolver egress, approved forwarding and monitored DNS filtering Assess latency-sensitive protocols and use buffering or alternative paths where viable Explanation Correct Answer A:Separating management reduces the exposure of high-impact control functions. Incorrect Answers B:VLAN separation is useful only when routed or firewall paths also enforce the intended trust boundary; it is relevant where two business units share one VLAN and cross-unit broadcast access violates isolation requirements, whereas the current facts require restrict management-plane reachability and authenticate administrative sessions independently to address the stated problem. C:For the separate situation in which a DNS architecture sends recursive resolvers directly to arbitrary Internet name servers without policy, dNS can become a bypass or exfiltration path unless resolver traffic is governed; here the stated problem requires restrict management-plane reachability and authenticate administrative sessions independently. D:Throughput capacity cannot remove the effects of propagation delay on request-response workflows; it is relevant where a satellite connection has very high round-trip delay, harming an interactive application, whereas the current facts require restrict management-plane reachability and authenticate administrative sessions independently to address the stated problem.
Question 178 A company wants to identify hidden internal east-west connections before defining segmentation. What should be gathered? Collect network flow and dependency evidence to build an accurate application communication map Place IoT endpoints in a separately controlled segment with explicit allowed egress Assess latency-sensitive protocols and use buffering or alternative paths where viable Perform per-resource authorization using device and identity context rather than VPN location alone Explanation Correct Answer A:Control design depends on real service dependencies, not assumed VLAN membership. Incorrect Answers B:Device category and trustworthiness should drive zone placement and traffic policy; this responds to the different circumstance in which an enterprise wants to prevent an untrusted IoT device from entering the employee production segment, while the current case states that a company wants to identify hidden internal east-west connections before defining segmentation, calling for collect network flow and dependency evidence to build an accurate application communication map. C:The other scenario states that a satellite connection has very high round-trip delay, harming an interactive application, where throughput capacity cannot remove the effects of propagation delay on request-response workflows; by contrast, the present case requires collect network flow and dependency evidence to build an accurate application communication map. D:For the separate situation in which a zero-trust deployment assumes users on an internal VPN may access every workload, network access is not equivalent to application authorization in a zero-trust model; here the stated problem requires collect network flow and dependency evidence to build an accurate application communication map.
Question 179 A data center uses one path for both production and backup replication, causing recovery traffic to starve transactions. What should be designed? Measure and control packet jitter, latency and loss for real-time traffic Apply capacity planning and quality-of-service policy or separate replication paths Perform per-resource authorization using device and identity context rather than VPN location alone Use a supported IPsec tunnel with authenticated peers and modern cryptographic proposals Explanation Correct Answer B:Availability needs predictable contention management for competing traffic classes. Incorrect Answers A:Voice quality depends on delay variation and loss, not merely peak bandwidth; this responds to the different circumstance in which a voice service suffers choppy calls despite ample average bandwidth, while the current case states that a data center uses one path for both production and backup replication, causing recovery traffic to starve transactions, calling for apply capacity planning and quality-of-service policy or separate replication paths. C:Network access is not equivalent to application authorization in a zero-trust model; this responds to the different circumstance in which a zero-trust deployment assumes users on an internal VPN may access every workload, while the current case states that a data center uses one path for both production and backup replication, causing recovery traffic to starve transactions, calling for apply capacity planning and quality-of-service policy or separate replication paths. D:IPsec can protect network-layer packet transport between trusted endpoints over hostile transit; this responds to the different circumstance in which a service requires a point-to-point encrypted tunnel across an untrusted IP carrier, while the current case states that a data center uses one path for both production and backup replication, causing recovery traffic to starve transactions, calling for apply capacity planning and quality-of-service policy or separate replication paths.
Question 180 A firewall allows outbound connections to every port from a sensitive data processing enclave. What is the defensible default? Define explicit destination and service allowlists with monitored exceptions Implement equivalent IPv6 routing, filtering and observability policies Collect network flow and dependency evidence to build an accurate application communication map Require authorized network admission and role-appropriate access beyond link encryption Explanation Correct Answer A:Least-privilege egress reduces external command-and-control and unapproved data movement. Incorrect Answers B:Dual-stack deployments introduce separate address and control surfaces that must be governed; this responds to the different circumstance in which a business sends sensitive IPv6 traffic but monitors only IPv4 firewall rules, while the current case states that a firewall allows outbound connections to every port from a sensitive data processing enclave, calling for define explicit destination and service allowlists with monitored exceptions. C:This option fits a different fact pattern where a company wants to identify hidden internal east-west connections before defining segmentation: control design depends on real service dependencies, not assumed VLAN membership; the current case instead requires define explicit destination and service allowlists with monitored exceptions. D:Encryption of radio frames alone does not establish need-to-know for the service network; although this helps when a research lab encrypts Wi-Fi but allows any employee to join a sensitive test network, it leaves the current case's need to define explicit destination and service allowlists with monitored exceptions unresolved.
