hardMultiple ChoiceObjective-mapped
CISSP Practice Question: During a security audit, it is discovered that…
Exhibit
Architecture Diagram Description: The system is composed of three tiers: web server in DMZ, application server in internal network, database server in secured network. All traffic between tiers must be encrypted using TLS. The database server only accepts connections from the application server on port 3306.
During a security audit, it is discovered that the database server is also accepting connections from the web server. Which of the following is the most likely misconfiguration?
⚠ Common exam trap
The trap here is that candidates may focus on authentication or encryption (options A or C) as the primary issue, but the core problem is the lack of network segmentation, which is a fundamental security architecture control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The network segmentation is not enforcing strict controls
The database server accepting connections from the web server indicates a lack of proper network segmentation. In a secure architecture, the web server should be in a DMZ and the database server in a private network segment, with strict access controls enforced by a firewall or router ACLs. The misconfiguration is that the network segmentation is not enforcing strict controls, allowing traffic that should be blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application server is not properly authenticated
Why it's wrong here
The application server's authentication status, whether proper or improper, pertains to its identity verification when accessing resources or services. Authentication mechanisms confirm 'who' or 'what' a server is, but they do not inherently control or restrict the underlying network-level connectivity or reachability between different network segments. A server, even if unauthenticated, might still be able to establish a network connection if network segmentation and firewall rules permit it.
- ✓
The network segmentation is not enforcing strict controls
Why this is correct
Network segmentation is a fundamental security control that logically divides a network into distinct security zones, enforcing strict communication policies between them, often using firewalls or VLANs. If a web server, typically residing in a less trusted DMZ, can directly establish a connection to a database server, which should be in a highly protected internal zone, it indicates a critical failure in these segmentation controls. This allows unauthorized network pathways, violating the principle of least privilege and exposing sensitive assets.
- ✗
The TLS configuration is incorrect
Why it's wrong here
TLS (Transport Layer Security) is a cryptographic protocol designed to provide secure communication over a computer network by encrypting data in transit and ensuring its integrity. While vital for protecting data confidentiality and integrity once a connection is established, TLS operates at the application layer and does not govern or restrict the establishment of the underlying network connection itself. An incorrect TLS configuration would compromise the security of data exchanged, not prevent the initial network access.
- ✗
The firewall on the database server allows all traffic from the DMZ
Why it's wrong here
While a firewall on the database server allowing all traffic from the DMZ is a critical vulnerability, it represents a specific misconfiguration within the broader network architecture. This permissive rule is a symptom of a deeper problem: the failure of the overall network segmentation strategy to enforce strict controls between security zones. The root cause lies in the inadequate design or implementation of the network segmentation policy, which should prevent such direct and unrestricted communication pathways from being permitted in the first place.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.