Section 16.154 Infrastructure Considerations

Question 1

Device Placement

Answer 1

Proper placement of routers, switches, and access points is crucial

Correct placement ensures:
● Optimal data flow,
● Minimies latency
● Enhances security

■ Routers at the network’s edge help filter traffic efficiently

■ Strategic placement of access points ensures coverage and reduces interference

■ Switches should be located for easy connection to network segments

Question 2

Security Zones and Screened Subnets

Security Zones

Answer 2

Isolate devices with similar security requirements

Question 3

Security Zones and Screened Subnets

Screened Subnets

Answer 3

● Act as buffer zones between internal and external networks

● Hosts public-facing services, protecting core internal networks

● Use the term “screened subnet” instead of “DMZ” for modern configurations

Question 4

Attack Surface

Answer 4

Refers to points where unauthorized access or data extraction can occur. Its the sum of all the potential vulnerabilitites and risk points inside a system, network or application.

■ A larger attack surface increases the risk of vulnerabilities

■ Identify and mitigate vulnerabilities to reduce the attack surface

■ Regularly assess and minimize the attack surface for network security

Question 5

Connectivity Methods

Answer 5

■ Choose connectivity methods that influence network performance, reliability, and security

■ Wired (e.g., Ethernet) offers stability and speed but restricts mobility

■ Wireless (e.g., Wi-Fi) provides flexibility but may suffer from interference and security issues

■ Consider factors like scalability, speed, security, and budget constraints when choosing connectivity methods

Question 6

Device Attributes

Answer 6

■ Consider whether devices are active or passive, and if they are inline or tapped

■ Active devices (e.g., intrusion prevention systems): monitor and act on network traffic.

■ Passive devices (e.g., intrusion detection systems): observe and report without altering traffic

■ Inline devices are in the path of network traffic

■ Taps and monitors capture data without disruption

■ Align device choices with network goals and challenges

Question 7

Failure Mode

Answer 7

■ Choose between “fail-open” and “fail-closed” modes to handle device failures

■ Fail-open: Allows traffic to pass during a failure, maintaining connectivity but reducing security

■ Fail-closed: Blocks all traffic during a failure, prioritising security over connectivity

■ The choice depends on the organization’s security policy and the criticality of the network segment