CSS CSS Network Security & Architecture 2

Question 1

Which VPN technology is commonly recommended for modern enterprise deployments due to its simplicity and performance?

Accepted Answer

WireGuard

Answer

WireGuard is a modern VPN protocol known for its lean codebase, high performance, and strong cryptographic defaults.

Question 2

What does the term 'east-west traffic' refer to in data center network security?

Accepted Answer

Lateral traffic between servers within the same data center

Answer

East-west traffic refers to internal server-to-server communication, which is a key focus for micro-segmentation strategies.

Question 3

Which security mechanism prevents a compromised VLAN from accessing other VLANs through switch exploitation?

Accepted Answer

Disabling trunk negotiation and using dedicated native VLANs

Answer

Disabling Dynamic Trunking Protocol and setting a dedicated unused native VLAN prevents VLAN hopping attacks.

Question 4

What is the primary role of an intrusion prevention system (IPS) compared to an IDS?

Accepted Answer

An IPS can actively block malicious traffic, while an IDS only detects and alerts

Answer

An IPS sits inline with traffic and can drop or block malicious packets, whereas an IDS is passive and only generates alerts.

Question 5

Which technique do security teams use to capture and analyze network packets for forensic investigation?

Accepted Answer

Packet capture (PCAP) analysis

Answer

PCAP files capture raw network traffic that analysts can replay and inspect using tools like Wireshark during investigations.

(CSS) Certified Security Sentinel Practice Test