ISSAP Network Security Architecture

Question 1

Which network security architecture principle involves placing systems in separate security zones to limit the blast radius of a breach?

Accepted Answer

Network segmentation

Answer

Protocol filtering

Answer

Bandwidth throttling

Answer

Port mirroring

Question 2

In a traditional three-tier network architecture, what is the primary security purpose of a DMZ (Demilitarized Zone)?

Accepted Answer

To isolate publicly accessible services from the internal network

Answer

To host internal databases securely

Answer

To terminate VPN connections from remote users

Answer

To aggregate logs from all internal systems

Question 3

A security architect is designing a Zero Trust network. Which of the following BEST describes the core tenet of Zero Trust?

Accepted Answer

Never trust, always verify — regardless of network location

Answer

All internal traffic is trusted by default

Answer

Trust is granted after a single successful authentication

Answer

Perimeter firewalls are sufficient to enforce trust boundaries

Question 4

Where should an Intrusion Detection System (IDS) sensor be placed to detect attacks targeting a public-facing web server in a DMZ?

Accepted Answer

Between the external firewall and the DMZ

Answer

Between the internal network and the DMZ firewall

Answer

On the internal LAN segment only

Answer

Behind the web server on the database segment

Question 5

Which firewall deployment model inspects traffic based on the state of network connections and is considered more secure than simple packet filtering?

Accepted Answer

Stateful inspection firewall

Answer

Stateless packet filtering

Answer

Application-layer proxy

Answer

Circuit-level gateway

Question 6

An enterprise wants to enforce consistent security policies for network access by verifying endpoint posture before granting connectivity. Which technology BEST supports this requirement?

Accepted Answer

Network Access Control (NAC)

Answer

VPN split tunneling

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Network Address Translation (NAT)

Question 7

Which VPN architecture model routes all remote user traffic — including internet-bound traffic — through the corporate network for inspection?

Accepted Answer

Full tunneling

Answer

Split tunneling

Answer

SSL portal VPN

Answer

Hub-and-spoke MPLS