NSE Security Architecture & Design 5 — Questions and Answers
Question 1: Which security design pattern places a reverse proxy in front of web applications to inspect and filter HTTP/S traffic before it reaches backend servers?
- Bastion host
- Web Application Firewall (WAF) (Correct answer)
- Network IDS
- SIEM
Correct answer: Web Application Firewall (WAF)
A WAF sits in front of web servers and inspects HTTP/S requests, blocking OWASP Top 10 attacks like SQL injection and XSS.
Question 2: An enterprise architect wants to ensure business continuity if the primary data center fails. What is the recommended RTO-focused design?
- Cold site backup with weekly tape restore
- Hot standby site with real-time synchronization and automated failover (Correct answer)
- Manual failover to a secondary site within 72 hours
- Single data center with RAID storage
Correct answer: Hot standby site with real-time synchronization and automated failover
A hot standby with real-time sync and automated failover minimizes Recovery Time Objective (RTO) to near-zero.
Question 3: Which Fortinet feature enables automatic threat intelligence sharing between Security Fabric components without manual administrator intervention?
- FortiGuard Outbreak Prevention
- Security Fabric Automated Response (SOAR integration)
- Threat Feed Connector
- FortiGuard IOC sync via Security Fabric (Correct answer)
Correct answer: FortiGuard IOC sync via Security Fabric
The Security Fabric automatically propagates FortiGuard threat intelligence (IOCs) across connected Fabric devices in real time.
Question 4: A penetration test reveals that a company's VPN allows split tunneling. What is the primary security concern?
- Increased VPN connection latency
- Corporate traffic bypasses security controls when routed through the internet (Correct answer)
- Users may lose access to local printers
- Certificate validation failures occur more frequently
Correct answer: Corporate traffic bypasses security controls when routed through the internet
With split tunneling, traffic destined for non-corporate sites bypasses the corporate firewall, potentially introducing threats into the environment.
Question 5: In secure architecture design, what is the role of a Hardware Security Module (HSM)?
- Accelerating SSL decryption only
- Providing tamper-resistant storage and management of cryptographic keys (Correct answer)
- Scanning network traffic for malware
- Managing user identity lifecycle
Correct answer: Providing tamper-resistant storage and management of cryptographic keys
An HSM is a dedicated hardware device that securely generates, stores, and manages cryptographic keys in a tamper-evident environment.
Question 6: Which architecture concept describes evaluating every access request as if it originates from an untrusted network, regardless of the user's physical location?
- Perimeter-based security
- Zero Trust Network Access (ZTNA) (Correct answer)
- Defense in depth
- Network segmentation
Correct answer: Zero Trust Network Access (ZTNA)
ZTNA enforces 'never trust, always verify' for every access request, treating internal and external networks with the same scrutiny.
Question 7: What distinguishes a stateful firewall from a stateless packet filter in security architecture?
- Stateful firewalls operate faster because they skip header inspection
- Stateful firewalls track connection state and context, allowing or blocking packets based on session history (Correct answer)
- Stateless firewalls require more memory than stateful ones
- Stateful firewalls only inspect UDP traffic
Correct answer: Stateful firewalls track connection state and context, allowing or blocking packets based on session history
Stateful firewalls maintain a connection table and evaluate packets in the context of established sessions, providing more accurate allow/deny decisions.
NSE Security Architecture & Design 5
Which security design pattern places a reverse proxy in front of web applications to inspect and filter HTTP/S traffic before it reaches backend servers?