Sample questions
Cse Network Perimeter Zero TrustDifficulty 1
A cloud security analyst reviews a security group rule allowing inbound TCP port 22 from 0.0.0.0/0. What is the primary risk this represents?
- aIt slows down SSH handshake performance for legitimate users
- bIt automatically disables encryption for the SSH session
- cIt forces the instance to use an outdated SSH protocol version instead of negotiating the strongest algorithm the client supports
- dAny host on the internet can attempt SSH connections to the instance✓
Explanation:0.0.0.0/0 means the rule matches every IPv4 source address, so any internet host can attempt to reach port 22. This dramatically increases exposure to brute-force and credential-stuffing attempts. It has no effect on handshake speed, protocol version, or encryption.
Cse Network Perimeter Zero TrustDifficulty 1
What is the key architectural difference between a security group and a network ACL (NACL) in most cloud VPC designs?
- aSecurity groups operate only at Layer 2, NACLs at Layer 3
- bSecurity groups are stateful (return traffic is auto-allowed), NACLs are typically stateless✓
- cNACLs can only allow traffic, security groups can only deny traffic
- dSecurity groups apply to entire VPCs and cannot be attached to individual instances, while NACLs apply only to single instances and ignore subnet boundaries
Explanation:Security groups are stateful: if inbound traffic is allowed, the corresponding return traffic is automatically permitted. NACLs operate at the subnet level and are typically stateless, requiring explicit rules for both directions. Both work above Layer 2, and both support allow and deny semantics (NACLs) or allow-only (security groups).
Cse Network Perimeter Zero TrustDifficulty 1
In zero-trust network access (ZTNA), what replaces the traditional assumption that traffic inside the corporate perimeter is trusted?
- aVPN concentrators become unnecessary and are removed entirely
- bAll internal traffic is left unencrypted since it never leaves the data center, on the assumption that anything already inside the building is inherently safe
- cOnly the outermost firewall performs any access control decisions
- dEvery access request is authenticated and authorized regardless of network location✓
Explanation:ZTNA's core principle is 'never trust, always verify': every request is authenticated and authorized based on identity, device posture, and context, regardless of whether it originates inside or outside the traditional perimeter. It does not mean leaving traffic unencrypted or centralizing all decisions at one firewall.
Cse Network Perimeter Zero TrustDifficulty 1
Why is 'lateral movement' a concern that a flat, unsegmented network makes worse?
- aA compromised host can reach many other systems without crossing an inspection or policy boundary✓
- bIt increases the monthly cost of data transfer between regions
- cIt prevents load balancers from performing health checks correctly, causing healthy backend instances to be marked as unavailable
- dIt makes DNS resolution slower across subnets
Explanation:In a flat network, once an attacker compromises one host, they can typically reach many other systems directly since there are few or no segmentation boundaries (firewalls, microsegmentation policies) to cross. This has no direct relation to DNS speed, cross-region cost, or load balancer health checks.
Cse Network Perimeter Zero TrustDifficulty 2
A security analyst finds a database subnet's NACL that allows all inbound traffic on all ports from the application subnet's CIDR range. What is the main concern with this configuration?
- aNACLs cannot reference CIDR ranges, so the rule is invalid and has no effect
- bAny port on any host in the application subnet can reach the database, not just the specific ports the application actually needs✓
- cThis configuration will cause the database to reject all legitimate connections, since NACLs that allow a range are treated as conflicting deny rules by the platform
- dNACL rules referencing CIDR ranges automatically expire after 24 hours
Explanation:Allowing all ports from an entire subnet CIDR violates least privilege: if any single host in the application subnet is compromised, or if a misconfigured service listens on an unexpected port, it gains broad reachability to the database. The rule is syntactically valid, does not block legitimate traffic, and NACL rules do not expire automatically.
Cse Network Perimeter Zero TrustDifficulty 2
What security benefit does a private endpoint (or PrivateLink-style connection) provide when an application accesses a managed cloud service such as object storage?
- aTraffic stays on the cloud provider's private network instead of traversing the public internet✓
- bIt removes the need for any authentication to the managed service
- cIt automatically encrypts data at rest with a customer-managed key, removing the need to configure any key management service separately
- dIt guarantees the managed service will have zero downtime
Explanation:Private endpoints route traffic through the provider's private backbone rather than the public internet, reducing exposure to internet-based interception or exfiltration paths and allowing tighter network-level access control. It does not remove authentication requirements, does not automatically manage encryption keys, and has no bearing on service uptime guarantees.