Read each question and choose an answer before opening its explanation. The rationale explains why the keyed response best meets the scenario and why attractive alternatives fall short.
Question 1·Objective 4.1: Secure network architecture: OSI/TCP-IP, IPv4/IPv6, secure and converged protocols, transport design, performance, traffic flows, segmentation, microsegmentation, edge/wireless/cellular/CDN, SDN/NFV/SD-WAN, VPC, and observability/management
After an acquisition, workloads from two companies share a cloud network with frequently changing IP addresses. The security architect must limit lateral movement between individual services without redesigning the physical network. Which approach BEST meets the requirement?
- A.Place the entire combined environment behind a larger perimeter firewall
- B.Assign permanent public IP addresses to every workload and filter them at the internet gateway
- C.Enforce identity-aware microsegmentation policies close to each workload
- D.Route all east-west traffic through the corporate web proxy
Show answer and explanation
Best answer: C. Enforce identity-aware microsegmentation policies close to each workload
Granular policies enforced near workloads constrain service-to-service communication and remain useful when network location changes. This directly addresses east-west lateral movement without requiring physical redesign.
A: A stronger perimeter does not provide granular controls between internal workloads.
B: Public addressing increases exposure and makes authorization depend on a changing network attribute rather than service identity.
C: Granular policies enforced near workloads constrain service-to-service communication and remain useful when network location changes. This directly addresses east-west lateral movement without requiring physical redesign.
D: A web proxy is not a general control for all service-to-service protocols and creates an unsuitable chokepoint.
Question 2·Objective 4.1: Secure network architecture: OSI/TCP-IP, IPv4/IPv6, secure and converged protocols, transport design, performance, traffic flows, segmentation, microsegmentation, edge/wireless/cellular/CDN, SDN/NFV/SD-WAN, VPC, and observability/management
Encrypted voice calls become unintelligible during brief traffic bursts even though average link utilization remains below 50 percent. Monitoring shows delay variation and dropped voice packets. Which change would MOST directly improve call quality?
- A.Prioritize real-time voice traffic with appropriate QoS queuing
- B.Increase DNS cache duration
- C.Replace TLS certificates more frequently
- D.Move voice endpoints into a larger IP subnet
Show answer and explanation
Best answer: A. Prioritize real-time voice traffic with appropriate QoS queuing
Real-time voice is sensitive to jitter, delay, and loss. QoS classification and low-latency queuing directly protect it during bursts.
A: Real-time voice is sensitive to jitter, delay, and loss. QoS classification and low-latency queuing directly protect it during bursts.
B: DNS caching does not control packet scheduling during congestion.
C: Certificate rotation does not address jitter or loss.
D: Subnet size does not guarantee priority or reduce burst congestion.
Question 3·Objective 4.1: Secure network architecture: OSI/TCP-IP, IPv4/IPv6, secure and converged protocols, transport design, performance, traffic flows, segmentation, microsegmentation, edge/wireless/cellular/CDN, SDN/NFV/SD-WAN, VPC, and observability/management
An organization believes it uses only IPv4, but a security review finds that employee operating systems automatically assigned IPv6 addresses and exchanged local IPv6 traffic. What is the MOST important response?
- A.Assume the traffic is safe because it is local
- B.Block IPv4 so administrators notice IPv6
- C.Tunnel all IPv6 traffic through an unmonitored IPv4 gateway
- D.Apply an explicit IPv6 policy and equivalent filtering, monitoring, and hardening or disable it where justified
Show answer and explanation
Best answer: D. Apply an explicit IPv6 policy and equivalent filtering, monitoring, and hardening or disable it where justified
Unmanaged IPv6 creates a parallel attack path. The organization must deliberately manage or disable it and apply controls equivalent to those protecting IPv4.
A: Local traffic can support discovery and lateral movement.
B: Disrupting IPv4 does not create an IPv6 security design.
C: Tunneling without visibility preserves the blind spot.
D: Unmanaged IPv6 creates a parallel attack path. The organization must deliberately manage or disable it and apply controls equivalent to those protecting IPv4.
Question 4·Objective 4.2: Infrastructure operations, media, NAC, and endpoint components
A contractor connects an authorized laptop to the corporate network, but the laptop is missing required endpoint protection. Which control BEST allows identity verification while limiting risk until the device is compliant?
- A.Grant normal access because the contractor authenticated successfully
- B.Disable endpoint posture checks for contractor devices
- C.Use network access control to place the device in a restricted remediation segment
- D.Publish the internal wireless password more frequently
Show answer and explanation
Best answer: C. Use network access control to place the device in a restricted remediation segment
NAC can evaluate user and device posture, then constrain a noncompliant endpoint to remediation resources rather than granting full access.
A: User authentication does not establish device health.
B: An exception increases exposure rather than managing it.
C: NAC can evaluate user and device posture, then constrain a noncompliant endpoint to remediation resources rather than granting full access.
D: Changing password publication does not enforce endpoint compliance.
Question 5·Objective 4.3: Secure channels for collaboration, remote access, data communications, and third parties
A hardware vendor needs occasional remote administrative access to critical servers. Which design BEST limits third-party risk while supporting maintenance?
- A.A shared vendor account reachable directly from the internet
- B.Emailing a new administrator password before each visit
- C.Permanent VPN access restricted only by source country
- D.Time-bound approved access through MFA and a monitored jump host with session logging
Show answer and explanation
Best answer: D. Time-bound approved access through MFA and a monitored jump host with session logging
Approval, time bounds, MFA, a controlled access path, and session accountability jointly reduce standing privilege and improve monitoring.
A: Shared direct access lacks individual accountability and layered control.
B: Emailing passwords is insecure and provides poor session control.
C: Country filtering is weak and permanent access increases exposure.
D: Approval, time bounds, MFA, a controlled access path, and session accountability jointly reduce standing privilege and improve monitoring.
Question 6·Objective 4.1: Secure network architecture: OSI/TCP-IP, IPv4/IPv6, secure and converged protocols, transport design, performance, traffic flows, segmentation, microsegmentation, edge/wireless/cellular/CDN, SDN/NFV/SD-WAN, VPC, and observability/management
Two business units require limited application communication but no lateral host access. What design BEST meets the requirement?
- A.Place both units on one flat subnet
- B.Allow all east-west traffic over TLS
- C.Use a shared administrator VLAN
- D.Segment the units and allow only explicit application flows
Show answer and explanation
Best answer: D. Segment the units and allow only explicit application flows
Segmentation plus explicit policy limits lateral movement while permitting needed flows.
A: This option may be useful elsewhere, but it does not meet the stated network-security objective.
B: This option may be useful elsewhere, but it does not meet the stated network-security objective.
C: This option may be useful elsewhere, but it does not meet the stated network-security objective.
D: Segmentation plus explicit policy limits lateral movement while permitting needed flows.
Question 7·Objective 4.1: Secure network architecture: OSI/TCP-IP, IPv4/IPv6, secure and converged protocols, transport design, performance, traffic flows, segmentation, microsegmentation, edge/wireless/cellular/CDN, SDN/NFV/SD-WAN, VPC, and observability/management
Network telemetry shows asymmetric routing through a stateful firewall. What is the PRIMARY concern?
- A.Return traffic may bypass session state and be dropped or unchecked
- B.DNS records will expire sooner
- C.Switch ports will negotiate lower speed
- D.Encryption keys will become shorter
Show answer and explanation
Best answer: A. Return traffic may bypass session state and be dropped or unchecked
Stateful inspection depends on observing the relevant connection flow.
A: Stateful inspection depends on observing the relevant connection flow.
B: This option may be useful elsewhere, but it does not meet the stated network-security objective.
C: This option may be useful elsewhere, but it does not meet the stated network-security objective.
D: This option may be useful elsewhere, but it does not meet the stated network-security objective.
Question 8·Objective 4.1: Secure network architecture: OSI/TCP-IP, IPv4/IPv6, secure and converged protocols, transport design, performance, traffic flows, segmentation, microsegmentation, edge/wireless/cellular/CDN, SDN/NFV/SD-WAN, VPC, and observability/management
A company adopts IPv6 but monitors only IPv4. What should security do FIRST?
- A.Disable all DNS
- B.Extend inventory, policy, and monitoring to IPv6 traffic
- C.Assume IPv6 is blocked by IPv4 firewalls
- D.Translate all traffic to email
Show answer and explanation
Best answer: B. Extend inventory, policy, and monitoring to IPv6 traffic
Unmonitored IPv6 can create a parallel path that bypasses intended controls.
A: This option may be useful elsewhere, but it does not meet the stated network-security objective.
B: Unmonitored IPv6 can create a parallel path that bypasses intended controls.
C: This option may be useful elsewhere, but it does not meet the stated network-security objective.
D: This option may be useful elsewhere, but it does not meet the stated network-security objective.
Question 9·Objective 4.2: Infrastructure operations, media, NAC, and endpoint components
A network access control system sees an unmanaged device requesting internal access. What is the BEST response?
- A.Grant full access because it has valid IP settings
- B.Block the switch permanently
- C.Place it in a restricted remediation network pending validation
- D.Disable logging to protect privacy
Show answer and explanation
Best answer: C. Place it in a restricted remediation network pending validation
Quarantine supports validation and remediation without granting inappropriate trust.
A: This option may be useful elsewhere, but it does not meet the stated network-security objective.
B: This option may be useful elsewhere, but it does not meet the stated network-security objective.
C: Quarantine supports validation and remediation without granting inappropriate trust.
D: This option may be useful elsewhere, but it does not meet the stated network-security objective.
Question 10·Objective 4.3: Secure channels for collaboration, remote access, data communications, and third parties
A vendor needs temporary remote administration of a critical server. Which design is BEST?
- A.Expose the server directly with a shared password
- B.Create a permanent domain administrator account
- C.Allow access from any vendor endpoint
- D.Use approved MFA access through a monitored jump host with time-bounded privilege
Show answer and explanation
Best answer: D. Use approved MFA access through a monitored jump host with time-bounded privilege
Brokered, monitored, time-limited access reduces third-party exposure.
A: This option may be useful elsewhere, but it does not meet the stated network-security objective.
B: This option may be useful elsewhere, but it does not meet the stated network-security objective.
C: This option may be useful elsewhere, but it does not meet the stated network-security objective.
D: Brokered, monitored, time-limited access reduces third-party exposure.
Continue studying Communication and Network Security
Review the complete Domain 4 guide, then mix this material with the other seven domains in an adaptive mock exam.