nerdexam
Cisco

350-201(NEW-127Q) · Question #78

An organization is undergoing a network hardening initiative to defend against increasingly sophisticated cyber threats. Their infrastructure supports multiple interconnected services, including…

The correct answer is D. Deploy next-generation firewalls with deep packet inspection, enforce ZTNA, and implement network microsegmentation to isolate sensitive assets. Option D directly addresses all three threat vectors identified in the scenario: NGFWs with deep packet inspection tackle encrypted traffic threats by analyzing packet contents beyond simple port/protocol filtering; ZTNA eliminates the implicit trust of traditional VPN access…

Network Security Architecture

Question

An organization is undergoing a network hardening initiative to defend against increasingly sophisticated cyber threats. Their infrastructure supports multiple interconnected services, including cloud-based systems, remote workforce connectivity, and external vendor integrations. Threat intelligence indicates that attackers are targeting weaknesses in network segmentation, lateral movement, and encrypted traffic inspection. To safeguard sensitive data and prevent unauthorized access, the organization must implement advanced network controls. The network includes VPN access, legacy devices, and diverse protocols used for communication. Which combination of network controls must the IT team implement to ensure robust hardening across the entire infrastructure?

Options

  • AConfigure IPS with machine learning driven threat detection, enforce NAC with multifactor authentication, and use NTA to monitor lateral movement.
  • BEnable VLAN-based segmentation, use WPA3 for all wireless communications, and deploy SSL inspection across encrypted traffic to identify hidden threats.
  • CImplement end-to-end encryption for all communications, implement RBAC across network devices, and deploy an AI-driven anomaly detection for threat response.
  • DDeploy next-generation firewalls with deep packet inspection, enforce ZTNA, and implement network microsegmentation to isolate sensitive assets.

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    17% (4)
  • C
    26% (6)
  • D
    52% (12)

Explanation

Option D directly addresses all three threat vectors identified in the scenario: NGFWs with deep packet inspection tackle encrypted traffic threats by analyzing packet contents beyond simple port/protocol filtering; ZTNA eliminates the implicit trust of traditional VPN access by verifying every user and device on every request, defeating lateral movement; and microsegmentation creates granular isolation zones so that even if an attacker breaches one segment, they cannot pivot to sensitive assets.

Why the distractors fall short:

  • A combines detection tools (IPS, NTA) with access control (NAC/MFA), but these are monitoring and authentication measures - they don't establish the architectural segmentation and trust model needed to prevent lateral movement at the network level.
  • B mixes VLAN segmentation (a legacy, coarser approach), WPA3 (wireless-only, irrelevant to the VPN/cloud/vendor context), and SSL inspection - no zero-trust enforcement and VLANs alone are insufficient against sophisticated pivoting.
  • C is self-contradicting: end-to-end encryption prevents the traffic inspection the scenario requires, and while RBAC and AI anomaly detection are useful, they address identity and detection rather than network-layer architecture.

Memory tip: When you see a scenario mentioning segmentation weaknesses + lateral movement + encrypted traffic, anchor on the "3-layer hardening stack" - Inspect (NGFW/DPI), Verify (ZTNA), Isolate (microsegmentation). If an answer has all three, it's almost certainly correct.

Topics

#Network Segmentation#Zero Trust Architecture#Deep Packet Inspection#Lateral Movement Prevention

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 350-201(NEW-127Q) Practice