Network Security Architecture Flashcards

Which network architecture model separates the network into distinct zones to limit the blast radius of a breach?

Answer: Defense-in-depth segmentation

Defense-in-depth segmentation divides the network into security zones so a compromised zone cannot directly reach all other assets.

A CNDA is designing a DMZ. Which traffic flow is considered best practice?

Answer: Internet → Firewall → DMZ → Firewall → Internal

A properly designed DMZ places firewalls on both sides so all traffic is inspected before reaching internal resources.

What is the primary purpose of a network baseline in security architecture?

Answer: To establish normal behavior for anomaly detection

A network baseline documents normal traffic patterns so deviations that may indicate an attack can be detected.

Which protocol is used to provide out-of-band management access to network devices?

Answer: Console via dedicated OOB network

Out-of-band management uses a separate dedicated network so devices remain accessible even when the production network is compromised.

In a zero-trust architecture, what is the guiding principle for granting network access?

Answer: Never trust, always verify regardless of location

Zero trust requires continuous verification of identity and device posture before granting access to any resource, internal or external.

A network architect wants to prevent lateral movement after a breach. Which technique is MOST effective?

Answer: Implementing micro-segmentation with strict ACLs

Micro-segmentation restricts east-west traffic so an attacker who compromises one host cannot freely move to adjacent systems.