CAS-003 · Question #615
A security engineer is making certain URLs from an internal application available on the Internet. The development team requires the following - The URLs are accessible only from internal IP…
The correct answer is B. A load balancer with GeolP restrictions and least-load-sensing traffic distribution. The four requirements are: (1) restrict access to internal IPs only, (2) block certain countries, (3) implement TLS, and (4) distribute traffic in round-robin. Option D (load balancer with IP ACL restrictions and a commercially available PKI certificate) satisfies requirements…
Question
A security engineer is making certain URLs from an internal application available on the Internet. The development team requires the following
- The URLs are accessible only from internal IP addresses
- Certain countries are restricted
- TLS is implemented.
- System users transparently access internal application services in a round robin to maximize
performance Which of the following should the security engineer deploy7
Options
- ADNS to direct traffic and a WAF with only the specific external URLs configured
- BA load balancer with GeolP restrictions and least-load-sensing traffic distribution
- CAn application-aware firewall with geofencing and certificate services using DNS for traffic
- DA load balancer with IP ACL restrictions and a commercially available PKI certificate
How the community answered
(36 responses)- A8% (3)
- B72% (26)
- C17% (6)
- D3% (1)
Explanation
The four requirements are: (1) restrict access to internal IPs only, (2) block certain countries, (3) implement TLS, and (4) distribute traffic in round-robin. Option D (load balancer with IP ACL restrictions and a commercially available PKI certificate) satisfies requirements 1 (IP ACL for internal-only access), 3 (PKI certificate provides TLS), and 4 (load balancers perform round-robin by default). Option B uses GeoIP for country restrictions but specifies least-load-sensing distribution rather than round-robin, and lacks explicit IP ACL controls. Option D most directly maps to the stated requirements - IP ACL, TLS via PKI, and round-robin via the load balancer - making it the best fit among the choices.
Topics
Community Discussion
No community discussion yet for this question.