NSE Security Architecture & Design 2 — Questions and Answers
Question 1: Which security architecture principle ensures that a compromised component cannot expose the entire system by limiting access between internal zones?
- Defense in depth
- Segmentation (Correct answer)
- Least privilege
- Zero trust
Correct answer: Segmentation
Segmentation isolates network zones so a breach in one segment cannot directly propagate to others.
Question 2: In a Fortinet Security Fabric deployment, what is the primary role of FortiAnalyzer?
- Firewall policy enforcement
- Centralized log management and analytics (Correct answer)
- Endpoint detection and response
- SD-WAN orchestration
Correct answer: Centralized log management and analytics
FortiAnalyzer aggregates logs from Fabric devices and provides centralized analytics and reporting.
Question 3: A security architect wants to enforce consistent policy across cloud and on-premises environments. Which Fortinet solution provides this unified management?
- FortiGate-VM
- FortiManager (Correct answer)
- FortiSIEM
- FortiDeceptor
Correct answer: FortiManager
FortiManager provides centralized configuration and policy management across physical and virtual FortiGate deployments.
Question 4: Which encryption approach is most appropriate when an organization needs to protect data confidentiality without the ability to inspect encrypted traffic for threats?
- TLS inspection at the perimeter
- End-to-end encryption (Correct answer)
- Asymmetric encryption only
- IPsec transport mode
Correct answer: End-to-end encryption
End-to-end encryption protects data from sender to recipient, but prevents intermediary inspection for threats.
Question 5: What does a 'trust but verify' model differ from a Zero Trust model in practical network design?
- Zero Trust requires biometric authentication for all users
- Trust but verify grants implicit internal network trust; Zero Trust requires continuous verification (Correct answer)
- Zero Trust eliminates the need for firewalls
- Trust but verify uses MFA while Zero Trust does not
Correct answer: Trust but verify grants implicit internal network trust; Zero Trust requires continuous verification
Traditional 'trust but verify' implicitly trusts internal users, whereas Zero Trust continuously validates every access request regardless of location.
Question 6: An NSE architect is designing a redundant perimeter. Which FortiGate high-availability mode provides active traffic processing on both units simultaneously?
- Active-Passive HA
- Active-Active HA (Correct answer)
- VRRP failover
- Standalone with ECMP
Correct answer: Active-Active HA
Active-Active HA allows both FortiGate units to process sessions concurrently, increasing throughput and providing redundancy.
Question 7: Which design principle minimizes the attack surface by removing unnecessary services, open ports, and default credentials from deployed systems?
- Fail-safe defaults
- Hardening (Correct answer)
- Compartmentalization
- Principle of open design
Correct answer: Hardening
Hardening reduces the attack surface by disabling unneeded features, closing unused ports, and enforcing secure defaults.
NSE Security Architecture & Design 2
Which security architecture principle ensures that a compromised component cannot expose the entire system by limiting access between internal zones?