NSE Security Architecture & Design 3 — Questions and Answers
Question 1: In a secure network design, what is the purpose of a DMZ (demilitarized zone)?
- To house internal HR systems
- To host public-facing services isolated from the internal network (Correct answer)
- To aggregate all VPN tunnels
- To store encrypted backups
Correct answer: To host public-facing services isolated from the internal network
A DMZ places public-facing servers between two firewalls, limiting exposure to the internal trusted network.
Question 2: Which cryptographic concept ensures that a sender cannot later deny having sent a message?
- Confidentiality
- Integrity
- Non-repudiation (Correct answer)
- Availability
Correct answer: Non-repudiation
Non-repudiation, typically enforced via digital signatures, prevents a sender from denying authorship of a message.
Question 3: When designing SD-WAN security, which FortiGate feature allows traffic steering based on application identity rather than just IP and port?
- BGP route policy
- ISDB-based application steering (Correct answer)
- OSPF cost metrics
- VLAN tagging
Correct answer: ISDB-based application steering
FortiGate's Internet Service Database (ISDB) enables SD-WAN rules to steer traffic based on recognized application or service identity.
Question 4: A Zero Trust architecture requires microsegmentation. What technology is commonly used to enforce microsegmentation in virtualized environments?
- VLAN trunking
- Software-defined networking (SDN) with host-based firewalls (Correct answer)
- Physical firewall appliances only
- NAC 802.1X only
Correct answer: Software-defined networking (SDN) with host-based firewalls
SDN combined with host-based firewalls enables granular microsegmentation policies per workload in virtualized environments.
Question 5: Which security architecture model defines security domains and mandatory access controls based on data classification labels?
- Bell-LaPadula model (Correct answer)
- Biba model
- Clark-Wilson model
- Brewer-Nash model
Correct answer: Bell-LaPadula model
The Bell-LaPadula model enforces confidentiality by controlling read/write access based on security classification labels.
Question 6: During a network security assessment, an architect discovers that inter-VLAN traffic is routed through a Layer 3 switch without firewall inspection. What is the key risk?
- Increased latency between VLANs
- Lateral movement between segments is uninspected (Correct answer)
- BGP routing instability
- DHCP conflicts between VLANs
Correct answer: Lateral movement between segments is uninspected
Without firewall inspection on inter-VLAN traffic, an attacker who compromises one VLAN can move laterally to others undetected.
Question 7: Which Fortinet solution provides inline SSL/TLS inspection to detect threats hidden in encrypted traffic?
- FortiProxy (Correct answer)
- FortiSandbox
- FortiNAC
- FortiAuthenticator
Correct answer: FortiProxy
FortiProxy performs full SSL/TLS deep inspection, decrypting and re-encrypting traffic to detect hidden malware and data exfiltration.
NSE Security Architecture & Design 3
In a secure network design, what is the purpose of a DMZ (demilitarized zone)?