ISSAP Network Security Architecture 2

Question 1

Micro-segmentation in a data center environment is MOST effective at controlling which type of traffic?

Accepted Answer

East-west traffic between workloads within the data center

Answer

Micro-segmentation applies granular policies to east-west (lateral) traffic between workloads inside the data center, preventing lateral movement by attackers.

Question 2

A security architect is leveraging Software-Defined Networking (SDN) for security. Which capability of SDN BEST enhances the security posture?

Accepted Answer

Enables centralized, programmable policy enforcement across the network

Answer

SDN's centralized control plane allows security policies to be programmatically defined and consistently enforced across all network devices from a single controller.

Question 3

Which DNS security extension provides cryptographic authentication of DNS responses to prevent cache poisoning attacks?

Accepted Answer

DNSSEC

Answer

DNSSEC adds digital signatures to DNS records, allowing resolvers to verify the authenticity and integrity of DNS responses and prevent cache poisoning.

Question 4

An architect needs to protect BGP routing infrastructure from route hijacking. Which security control BEST addresses this threat?

Accepted Answer

Implementing Resource Public Key Infrastructure (RPKI) with Route Origin Authorization

Answer

RPKI with Route Origin Authorization (ROA) cryptographically validates that BGP route announcements originate from authorized Autonomous Systems, mitigating route hijacking.

Question 5

Which network security monitoring approach captures full packet data for retrospective analysis of security incidents?

Accepted Answer

Full packet capture (PCAP)

Answer

Full packet capture (PCAP) records the complete contents of network packets, enabling security analysts to reconstruct sessions and perform detailed forensic analysis after an incident.

ISSAP - Information Systems Security Architecture Professional Practice Test

ISSAP - Information Systems Security Architecture Professional Practice Test

ISSAP Network Security Architecture 2