GSEC Defensible Network Architecture — 10 Questions

Question 1

A healthcare organization is redesigning its data center to meet HIPAA segmentation requirements. The security architect must ensure that the web tier, application tier, and database tier can only communicate with adjacent tiers, and that no tier can initiate connections directly to the database except the application tier. The organization wants to enforce this using a single physical firewall with the fewest possible interfaces. Which deployment best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the firewall in routed mode with three interfaces, one per tier, and write rules that permit only web-to-app and app-to-db flows.. Segmenting the web, application, and database tiers into separate firewall interfaces creates distinct security zones. Inter-zone traffic must pass through the firewall, where a default-deny posture and explicit permits for web-to-app and app-to-db enforce the required flow. The database zone has no inbound rule from the web zone, so direct connections are blocked. This approach provides clear policy enforcement, logging, and auditability with a single firewall.

Answer

Deploy the firewall in a one-armed (router-on-a-stick) configuration with a single physical interface carrying all three tiers as subinterfaces.

Answer

Deploy the firewall in transparent mode between each tier, using separate VLANs and 802.1Q trunking to enforce inter-VLAN policies.

Answer

Deploy the firewall in routed mode with two interfaces, placing the web and application tiers on the same interface and the database on the other.

Question 2

A security engineer is reviewing the design of a demilitarized zone (DMZ) that hosts a public web server, a mail relay, and a DNS server. The current design places all three servers on the same VLAN behind a single firewall interface, and the firewall allows any DMZ host to initiate connections to any other DMZ host. The engineer wants to reduce the blast radius if one server is compromised. Which change BEST achieves this goal while preserving required service functionality?

Accepted Answer

Enable private VLANs (PVLANs) on the DMZ switch so each server is an isolated port, and allow only the firewall promiscuous port to communicate with all isolated ports.. Segmenting the DMZ so each public-facing server cannot initiate connections to its peers limits lateral movement after a compromise. Private VLANs provide that isolation at Layer 2 while the firewall's promiscuous port retains the ability to broker all required inbound and outbound flows. Moving servers inward, authenticating ports, or adding Layer 2 anti-spoofing controls do not break the peer-to-peer reachability that enables east-west spread.

Answer

Move all three servers to the internal trusted VLAN and rely on host-based firewalls on each server to block unwanted internal connections.

Answer

Configure 802.1X with MAC authentication bypass on the DMZ switch ports so only known servers can connect to the DMZ VLAN.

Answer

Enable DHCP snooping and dynamic ARP inspection on the DMZ VLAN to prevent ARP spoofing between the three servers.

Question 3

A security team is building a defensible architecture for a new branch office that connects to headquarters over the public internet. The design must protect data confidentiality and integrity in transit and must prevent a compromised branch router from silently redirecting traffic to an attacker. Which two design elements best satisfy these requirements? (Choose two.)

Accepted Answer

Establish an IPsec VPN tunnel between the branch router and the headquarters VPN concentrator using IKEv2 with certificate-based authentication and strong encryption and integrity algorithms.. Confidentiality and integrity across an untrusted path require encryption and authentication of the traffic itself, which IPsec delivers whether as a point-to-point IKEv2 tunnel or as an IPsec-protected DMVPN overlay. Routing authentication and static routes harden control-plane behavior but leave payloads in cleartext and do not constrain a router that an attacker already controls. Only cryptographic protection of the data path meets both stated goals.

Answer

Configure the branch router with static routes to headquarters and enable unicast reverse path forwarding on all interfaces.

Answer

Deploy a routing protocol authentication mechanism such as OSPF or BGP MD5/TCP-AO authentication on the branch-to-headquarters routing adjacencies.

Answer

Rely on the public internet's native BGP security and TLS on application traffic to protect the branch-to-headquarters path.

Question 4

An enterprise network administrator needs to isolate a new public-facing web application so that a compromise of the web server does not immediately expose the internal corporate database and directory services. Which network architecture design pattern provides the most effective defense for this scenario?

Accepted Answer

Configuring a demilitarized zone (DMZ) flanked by firewalls to separate public-facing web assets from internal network resources.. Deploying a demilitarized zone (DMZ) creates a buffered network segment between the untrusted public internet and the trusted internal corporate network. By placing the web server in the DMZ and utilizing firewalls to restrict inbound and outbound traffic flows, administrators successfully contain potential breaches. This defensive architecture stops attackers from pivoting directly into sensitive internal resources following an initial web application compromise.

Answer

Deploying the web server on the internal corporate VLAN alongside domain controllers to streamline administrative access and reduce network latency.

Answer

Implementing a flat network topology utilizing unmanaged switches to maximize throughput and simplify routing tables for incoming web traffic.

Answer

Connecting the web server directly to the outer provider edge router via a public bridge to bypass internal switching bottlenecks.

Question 5

A security engineer is designing a secure enterprise environment and needs to deploy network intrusion detection sensors to monitor east-west traffic moving between virtual machines inside an internal virtualization cluster. Which deployment method ensures the sensors successfully inspect internal segment traffic without introducing a single point of failure for packet forwarding?

Accepted Answer

Configuring hypervisor-level distributed virtual switches to mirror east-west traffic to dedicated virtual security monitoring appliances.. Using virtual tap interfaces or distributed software switches configured for port mirroring allows security sensors to receive copies of internal traffic traversing the hypervisor backplane. This approach ensures comprehensive visibility into east-west lateral movement without altering inline packet forwarding paths, maintaining network availability while delivering the necessary telemetry for threat detection engines.

Answer

Placing a dedicated physical inline bump-in-the-wire network intrusion prevention system between every internal virtual switch uplink.

Answer

Routing all inter-VLAN traffic through a single legacy perimeter firewall using hardware router-on-a-stick configurations.

Answer

Disabling all stateful packet inspection on internal firewalls to allow maximum throughput for east-west virtualization traffic.

Question 6

An organization is hardening its internal corporate network architecture to prevent unauthorized hosts from connecting to switch ports in common areas and conference rooms. Which TWO configurations should the network engineering team implement to achieve this security objective? (Choose TWO)

Accepted Answer

Enabling 802.1X port-based authentication integrated with a RADIUS server and extensible authentication protocol.. Implementing 802.1X port-based authentication forces every connecting device to authenticate against a central directory service before gaining network access. Combined with port security limits that restrict the maximum number of registered MAC addresses per switch port, organizations effectively block rogue devices and unauthorized hardware from establishing unauthorized network connections in public areas.

Answer

Configuring static routing protocols on all access layer switches to bypass dynamic route poisoning attacks.

Answer

Deploying unmanaged network hubs in conference rooms to simplify physical cable management and port density.

Answer

Disabling spanning tree protocol root guard on all core enterprise switches to accelerate topology convergence times.

Question 7

During an internal network security audit, an engineer discovers that workstations on the human resources VLAN can directly communicate with sensitive database servers on the finance VLAN without passing through a filtering device. Which foundational architectural control is missing from this environment?

Accepted Answer

Enforcing inter-VLAN access control lists or deploying an internal firewall to inspect and restrict traffic between functional zones.. Micro-segmentation and internal routing firewalls are essential for enforcing least privilege communication between distinct functional business units. When VLANs reside on a core router or multi-layer switch without inter-VLAN access control lists, traffic flows freely between security zones. Implementing internal firewalls between these segments ensures that human resources workstations only access authorized HR applications.

Answer

Deploying a high-availability server load balancer in front of the human resources workstation subnet.

Answer

Upgrading all edge routers to support Border Gateway Protocol with strict cryptographic route validation.

Answer

Replacing all traditional dynamic host configuration protocol scopes with static IP address assignments.

Question 8

A security architect is hardening an organization's network infrastructure against reconnaissance and layer-2 attacks. Which TWO actions should the engineering team take to mitigate common switch-based vulnerabilities? (Choose TWO)

Accepted Answer

Disabling dynamic trunking protocol on all user-facing access layer switch ports.. Mitigating layer-2 vulnerabilities requires disabling dynamic trunking protocol auto-negotiation and explicitly setting native VLAN identifiers to unused, isolated values. Disabling dynamic trunk negotiation stops rogue switches from forming trunk links, while changing the native VLAN prevents VLAN hopping attacks that exploit un-tagged traffic handling on trunk links.

Answer

Enabling dynamic ARP inspection across all core routing interfaces without configuring DHCP snooping bindings.

Answer

Routing all broadcast domain traffic through unmanaged Layer-1 repeating hubs to obscure physical topology.

Answer

Installing public-facing web servers directly into the native management VLAN of the core enterprise switches.

Question 9

An enterprise network design utilizes an out-of-band management network for all core routers, firewalls, and switches. The management network is physically separated from the production data plane and uses dedicated management switches. What is the primary security advantage of this defensible architecture?

Accepted Answer

It prevents compromised production workloads from launching lateral attacks against device management planes.. An out-of-band management network isolates administrative traffic from production data flows, ensuring that an operational disruption or compromise of the data plane does not lock administrators out of their infrastructure devices. This separation prevents lateral movement from compromised user workstations directly into device management interfaces, protecting critical administrative access paths.

Answer

It completely eliminates the requirement to encrypt administrative SSH and HTTPS sessions across the network core.

Answer

It automatically accelerates routing convergence times across all enterprise boundary routers by removing administrative overhead.

Answer

It allows network operators to utilize unauthenticated cleartext telnet connections without risking confidentiality breaches.

Question 10

Refer to the exhibit. A network administrator configured port security on a switch interface to protect against unauthorized device connections. Based on the provided configuration snippet, what action will the switch take if a third device with an unknown MAC address connects to this port?

Accepted Answer

The switch will immediately transition the interface into an error-disabled state and shut down port operations.. When port security is configured with a maximum limit of two MAC addresses and a violation mode of shutdown, the switch immediately disables the interface the moment a third unique MAC address attempts to communicate. The port enters an error-disabled state, dropping all traffic until an administrator manually resets the interface or configures an automatic recovery timer.

Answer

The switch will forward the third device's traffic while generating an alert log entry to the central syslog server without dropping packets.

Answer

The switch will drop packets originating from the third device while keeping the physical port in an active operational state.

Answer

The switch will temporarily quarantine the third device in a restricted guest VLAN while awaiting administrator approval.