ISSAP Network Security Architecture 3

Question 1

An organization is transitioning to IPv6. Which security consideration is MOST important for a security architect to address during the transition?

Accepted Answer

Dual-stack environments may expose IPv6 interfaces that bypass existing IPv4 security controls

Answer

IPv6 eliminates the need for network address translation

Answer

IPv6 uses smaller address spaces that simplify firewall rule management

Answer

IPv6 does not support IPsec and requires alternative encryption

Question 2

Which design approach BEST improves network resilience by eliminating single points of failure at the network layer?

Accepted Answer

Implementing redundant links with dynamic routing protocols such as OSPF or BGP

Answer

Using a single high-capacity firewall with RAID storage

Answer

Deploying all servers in a single subnet for easier management

Answer

Consolidating all switching to one core switch with a hot spare

Question 3

An ISSAP candidate is reviewing a network design that uses out-of-band (OOB) management. What is the PRIMARY security benefit of OOB management?

Accepted Answer

It isolates management traffic from production traffic, preserving access during attacks or outages

Answer

It reduces latency for production traffic

Answer

It eliminates the need for encrypted management protocols like SSH

Answer

It automatically patches network devices when new firmware is available

Question 4

When designing network security architecture, which concept ensures that only the minimum necessary network traffic is permitted between zones by default?

Accepted Answer

Default deny (implicit deny) policy

Answer

Default allow with logging

Answer

Stateful inspection only

Answer

Application-layer awareness

Question 5

A security architect must ensure that sensitive network traffic between data centers is protected in transit. Which solution provides both confidentiality and integrity for this traffic?

Accepted Answer

IPsec tunnel mode between data center gateways

Answer

QoS tagging on the WAN links

Answer

MPLS traffic engineering without encryption

Answer

Using private WAN circuits without additional encryption

Question 6

Which network security architecture model uses software-defined perimeters to make infrastructure invisible to unauthorized users before authentication occurs?

Accepted Answer

Software-Defined Perimeter (SDP) / Zero Trust Network Access (ZTNA)

Answer

Traditional firewall-based perimeter

Answer

VPN with split tunneling

Answer

NAT-based access control

Question 7

When conducting a network security architecture review, an architect evaluates trust zones. Which factor is MOST critical when defining trust zone boundaries?

Accepted Answer

The sensitivity of data and systems within the zone and the risk of interconnection

Answer

The physical location of network switches

Answer

The number of users accessing each zone

Answer

The age and model of network hardware in each segment