NSE Security Architecture & Design 3

Question 1

In a secure network design, what is the purpose of a DMZ (demilitarized zone)?

Accepted Answer

To host public-facing services isolated from the internal network

Answer

A DMZ places public-facing servers between two firewalls, limiting exposure to the internal trusted network.

Question 2

Which cryptographic concept ensures that a sender cannot later deny having sent a message?

Accepted Answer

Non-repudiation

Answer

Non-repudiation, typically enforced via digital signatures, prevents a sender from denying authorship of a message.

Question 3

When designing SD-WAN security, which FortiGate feature allows traffic steering based on application identity rather than just IP and port?

Accepted Answer

ISDB-based application steering

Answer

FortiGate's Internet Service Database (ISDB) enables SD-WAN rules to steer traffic based on recognized application or service identity.

Question 4

A Zero Trust architecture requires microsegmentation. What technology is commonly used to enforce microsegmentation in virtualized environments?

Accepted Answer

Software-defined networking (SDN) with host-based firewalls

Answer

SDN combined with host-based firewalls enables granular microsegmentation policies per workload in virtualized environments.

Question 5

Which security architecture model defines security domains and mandatory access controls based on data classification labels?

Accepted Answer

Bell-LaPadula model

Answer

The Bell-LaPadula model enforces confidentiality by controlling read/write access based on security classification labels.

(NSE) Network Security Expert Practice Test