ISSAP Network Security Architecture

Question 1

Which network security architecture principle involves placing systems in separate security zones to limit the blast radius of a breach?

Accepted Answer

Network segmentation

Answer

Network segmentation divides a network into isolated zones so that a compromise in one zone cannot directly spread to others, limiting the breach's blast radius.

Question 2

In a traditional three-tier network architecture, what is the primary security purpose of a DMZ (Demilitarized Zone)?

Accepted Answer

To isolate publicly accessible services from the internal network

Answer

The DMZ hosts publicly accessible services (e.g., web servers) while isolating them from the internal network, so external threats cannot directly reach internal resources.

Question 3

A security architect is designing a Zero Trust network. Which of the following BEST describes the core tenet of Zero Trust?

Accepted Answer

Never trust, always verify — regardless of network location

Answer

Zero Trust operates on 'never trust, always verify,' requiring continuous authentication and authorization for every request regardless of where it originates.

Question 4

Where should an Intrusion Detection System (IDS) sensor be placed to detect attacks targeting a public-facing web server in a DMZ?

Accepted Answer

Between the external firewall and the DMZ

Answer

Placing an IDS sensor between the external firewall and the DMZ allows it to inspect inbound traffic destined for DMZ services before it reaches those servers.

Question 5

Which firewall deployment model inspects traffic based on the state of network connections and is considered more secure than simple packet filtering?

Accepted Answer

Stateful inspection firewall

Answer

A stateful inspection firewall tracks the state of active connections and uses this context to enforce policy, blocking packets that don't belong to a known legitimate session.

ISSAP - Information Systems Security Architecture Professional Practice Test

ISSAP - Information Systems Security Architecture Professional Practice Test

ISSAP Network Security Architecture