CSS CSS Network Security & Architecture 1

Question 1

Which network segmentation technique isolates critical assets by placing them in a separate zone with strict access controls?

Accepted Answer

DMZ (Demilitarized Zone)

Answer

A DMZ places public-facing services in an isolated network zone, protecting internal assets from direct exposure.

Question 2

What is the primary purpose of a next-generation firewall (NGFW) compared to a traditional stateful firewall?

Accepted Answer

Deep packet inspection and application-layer filtering

Answer

NGFWs add deep packet inspection and application-layer awareness beyond the port/protocol filtering of stateful firewalls.

Question 3

Which protocol is used to encrypt DNS queries to prevent eavesdropping and tampering?

Accepted Answer

DNS over HTTPS (DoH)

Answer

DNS over HTTPS encrypts DNS queries within HTTPS traffic, preventing interception by third parties.

Question 4

What does a Zero Trust network architecture assume about users and devices?

Accepted Answer

No user or device is trusted by default, even inside the network perimeter

Answer

Zero Trust assumes breach and requires continuous verification of every user, device, and connection regardless of location.

Question 5

Which type of attack exploits weakly configured routers to redirect traffic through an attacker-controlled path?

Accepted Answer

BGP hijacking

Answer

BGP hijacking manipulates Border Gateway Protocol routes to redirect internet traffic through malicious infrastructure.

(CSS) Certified Security Sentinel Practice Test