A network architect is working on a new network design to better support remote and on-campus workers. Traffic needs to be decrypted for inspection in the cloud but is not required to go through the company's data center. Which of the following technologies best meets these requirements?
Correct Answer:A. Secure web gateway
Explanation:
A cloud-delivered Secure Web Gateway can terminate and decrypt user HTTPS sessions directly in the cloud for policy enforcement and inspection without hair-pinning traffic back through the data center.
Question 2
A customer asks a MSP to propose a ZTA design for its globally distributed remote workforce. Given the following requirements:
Authentication should be provided through the customer's SAML identity provider.
Access should not be allowed from countries where the business does not operate.
Secondary authentication should be added to the workflow to allow for passkeys.
Changes to the user's device posture and hygiene should require reauthentication into the network.
Access to the network should only be allowed to originate from corporate-owned devices.
Which of the following solutions should the MSP recommend to meet the requirements?
Correct Answer:D. Configure geolocation settings to block certain IP addresses.
Enforce MFA.
Federate the solution via SSO.
Enable continuous access policies on the WireGuard tunnel.
Create a trusted endpoints policy.
Explanation:
Federate the solution via SSO ensures authentication is handled by the customer's SAML identity provider.
Enforce MFA supports secondary authentication with passkeys.
Configure geolocation settings to block certain IP addresses prevents access from unauthorized countries.
Enable continuous access policies on the WireGuard tunnel forces re-authentication whenever device posture or hygiene changes.
Create a trusted endpoints policy restricts access to corporate-owned devices only.
Question 3
A company is migrating an application to the cloud for modernization. The engineer needs to provide dependencies between application and database tiers in the environment. Which of the following should the engineer reference in order to best meet this requirement?
Correct Answer:B. CMDB
Explanation:
A Configuration Management Database (CMDB) explicitly maps and documents the relationships and dependencies among configuration items, such as your application and database tiers, making it the ideal reference when migrating to the cloud.
Question 4
A partner is migrating a client from on premises to a hybrid cloud. Given the following project status information, the initial project timeline estimates need to be revised:
Which of the following documents needs to be revised to best reflect the current status of the project?
Correct Answer:D. WBS
Explanation:
The Work Breakdown Structure is where each project phase and its duration are documented in detail. Since the estimated timelines for discovery, design, implementation, and knowledge transfer have all slipped, you update the WBS to reflect the new, actual phase durations.
Question 5
A network administrator is troubleshooting a user's workstation that is unable to connect to the company network. The results of commands the administrator runs on the workstation are shown below:
A router on the same network shows the following output:
Which of the following is the most likely cause of the issues?
Correct Answer:B. IP address conflict
Question 6
A company is experiencing numerous network issues and decides to expand its support team. The new junior employees will need to be onboarded in the shortest time possible and be able to troubleshoot issues with minimal assistance. Which of the following should the company create to achieve this goal?
Correct Answer:B. Clearly documented runbooks for networking issues and knowledge base articles
Explanation:
Runbooks provide step-by-step troubleshooting procedures, and a solid knowledge base captures known issues and resolutions. Together they let new team members ramp up quickly and resolve common network problems with minimal hand-holding.
Question 7
A company has a 40Gbps network that uses a network tap to inspect the traffic using an IDS. The IDS usually performs normally except when the servers are downloading patches from their local update repository 10.10.10.139 using HTTPS. During the patch windows, the IDS cannot handle the extra load and drops a significant number of packets. Which of the following would allow a network engineer to prevent this issue without compromising the network visibility?
Correct Answer:C. Adding a 'dst host 10.10.10.139' BPF on the tap
Explanation:
By applying a Berkeley Packet Filter to drop only the HTTPS patchrepo traffic before it reaches the IDS, you relieve the processing burden during patch windows while preserving full visibility for all other flows. This avoids reconfiguring the IDS itself or losing visibility across the rest of the network.
Question 8
Security policy states that all inbound traffic to the environment needs to be restricted, but all external outbound traffic is allowed within the hybrid cloud environment. A new application server was recently set up in the cloud. Which of the following would most likely need to be configured so that the server has the appropriate access set up? (Choose two.)
Correct Answer:D. Firewall; E. Network security group
Explanation:
A perimeter firewall enforces the organization's ''deny inbound by default, allow all outbound'' policy at the edge of the cloud environment, while an Azure-style NSG applies the same rule set at the VM/subnet level. Together they ensure no inbound connections slip through and that outbound traffic remains unrestricted.
Question 9
An organization has centralized logging capability at the on-premises data center and wants a solution that can consolidate logging from deployed cloud workloads. The organization would like to automate the detection and alerting mechanism. Which of the following best meets the requirements?
Correct Answer:B. SIEM
Explanation:
A Security Information and Event Management system ingests and normalizes logs from on-premises and cloud sources, applies automated correlation rules for detection, and issues alerts, exactly matching the need for centralized logging, analysis, and automated notification.
Question 10
Which of the following helps the security of the network design to align with industry best practices?
Correct Answer:A. Reference architectures
Explanation:
Reference architectures provide standardized, vendor-agnostic blueprints that incorporate industry best practices for security, ensuring your network design aligns with proven frameworks.
