DOMAIN 7 - CHALLENGES OF VIRTUAL APPLIANCES, SDN SECURITY BENEFITS

Question 1

Virtual appliances thus become ______, since they cannot fail open, and must intercept all traffic.

Answer 1

bottlenecks

Question 2

________may take significant resources and increase costs to meet network performance requirements.

Answer 2

Virtual appliances

Question 3

When used, virtual appliances should support _______ to match the elasticity of the resources they protect.

Answer 3

auto-scaling

Question 4

Virtual appliances should also be aware of operating in the cloud, as well as the ability of instances to move between different geographic and availability zones. The ______ of change in cloud networks is higher than that of physical networks and tools need to be designed to handle this important difference.

Answer 4

velocity

Question 5

______ will change far more quickly than on a traditional network, which security tools must account for.

Answer 5

IP addresses

Question 6

_______ are less likely to exist at static IP addresses

Answer 6

Assets

Question 7

It becomes possible to build out as many ______ networks as you need without constraints of physical hardware.

Answer 7

isolated

Question 8

________ (e.g., security groups) can apply to assets based on more flexible criteria than hardware-based firewalls, since they aren’t limited based on physical topology.

Answer 8

SDN firewalls

Question 9

SDN firewalls are typically______ sets that define ingress and egress rules that can apply to single
assets or groups of assets, regardless of network location (within a given virtual network).

Answer 9

policy

Question 10

________is often the starting point, and you are required to open connections from there, which is the opposite of most physical networks

Answer 10

Default deny

Question 11

Many network attacks are eliminated by default (depending on your platforms), such as _______ and other lower level exploits, beyond merely eliminating sniffing. This is due to the inherent nature of the SDN and application of more software based
rules and analysis in moving packets.

Answer 11

ARP spoofing

Question 12

As with security groups, other routing and network design can be dynamic and tied to the cloud’s ________ layer, such as bridging virtual networks or connecting to internal PaaS services.

Answer 12

orchestration