CSS Network Security & Architecture Flashcards
6 cards from real CSS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CSS Network Security & Architecture flashcards as text
Which network segmentation technique isolates critical assets by placing them in a separate zone with strict access controls?
Answer: DMZ (Demilitarized Zone)
A DMZ places public-facing services in an isolated network zone, protecting internal assets from direct exposure.
What is the primary purpose of a next-generation firewall (NGFW) compared to a traditional stateful firewall?
Answer: Deep packet inspection and application-layer filtering
NGFWs add deep packet inspection and application-layer awareness beyond the port/protocol filtering of stateful firewalls.
Which protocol is used to encrypt DNS queries to prevent eavesdropping and tampering?
Answer: DNS over HTTPS (DoH)
DNS over HTTPS encrypts DNS queries within HTTPS traffic, preventing interception by third parties.
What does a Zero Trust network architecture assume about users and devices?
Answer: No user or device is trusted by default, even inside the network perimeter
Zero Trust assumes breach and requires continuous verification of every user, device, and connection regardless of location.
Which type of attack exploits weakly configured routers to redirect traffic through an attacker-controlled path?
Answer: BGP hijacking
BGP hijacking manipulates Border Gateway Protocol routes to redirect internet traffic through malicious infrastructure.
What is the function of a network access control (NAC) system in enterprise security?
Answer: Enforces security policy compliance before granting network access
NAC systems assess endpoint health and policy compliance, granting or restricting network access based on the results.