ISSAP Network Security Architecture 3

Question 1

An organization is transitioning to IPv6. Which security consideration is MOST important for a security architect to address during the transition?

Accepted Answer

Dual-stack environments may expose IPv6 interfaces that bypass existing IPv4 security controls

Answer

In dual-stack environments, systems expose both IPv4 and IPv6 interfaces; existing security controls configured only for IPv4 may not inspect IPv6 traffic, creating blind spots.

Question 2

Which design approach BEST improves network resilience by eliminating single points of failure at the network layer?

Accepted Answer

Implementing redundant links with dynamic routing protocols such as OSPF or BGP

Answer

Redundant links combined with dynamic routing protocols allow traffic to automatically reroute around failures, eliminating single points of failure and improving network resilience.

Question 3

An ISSAP candidate is reviewing a network design that uses out-of-band (OOB) management. What is the PRIMARY security benefit of OOB management?

Accepted Answer

It isolates management traffic from production traffic, preserving access during attacks or outages

Answer

Out-of-band management uses a separate network path for administrative access, ensuring that management connectivity is preserved even when production network paths are congested or under attack.

Question 4

When designing network security architecture, which concept ensures that only the minimum necessary network traffic is permitted between zones by default?

Accepted Answer

Default deny (implicit deny) policy

Answer

A default deny (implicit deny) policy blocks all traffic not explicitly permitted by firewall rules, ensuring attackers cannot exploit undefined or forgotten rule gaps.

Question 5

A security architect must ensure that sensitive network traffic between data centers is protected in transit. Which solution provides both confidentiality and integrity for this traffic?

Accepted Answer

IPsec tunnel mode between data center gateways

Answer

IPsec tunnel mode encrypts the entire original IP packet and provides both confidentiality and integrity verification, protecting data in transit between data centers.

ISSAP - Information Systems Security Architecture Professional Practice Test

ISSAP - Information Systems Security Architecture Professional Practice Test

ISSAP Network Security Architecture 3