CCNP Security 300-745 SDSI Practice Test 13

Correct Answer: Restricting communication between individual microservices to only what is explicitly required for legitimate function, limiting the blast radius if any single microservice is compromised
Explanation: Microsegmentation restricts inter-service communication to only what's required, limiting blast radius if a service is compromised, unlike granting unrestricted default access, using a flat unsegmented network, assuming inherent security with no policy, granting unrestricted internet access, or removing logging/monitoring.

Correct Answer: Kubernetes NetworkPolicy resources, which define allowed ingress/egress traffic between pods based on labels and namespaces
Explanation: Kubernetes NetworkPolicy resources define label- and namespace-based ingress/egress rules between pods for segmentation, unlike a physical firewall inside each container, a manually maintained spreadsheet, a shared cluster-wide password, a DNS zone transfer restriction, or a printer ACL.

Correct Answer: Performing application dependency discovery and mapping (observing actual traffic flows between microservices) before defining default-deny, allowlist-based segmentation policy
Explanation: Dependency discovery and mapping of actual traffic flows before writing default-deny allowlist policy ensures accuracy, unlike defining policy from assumptions with no observed data, applying an identical template regardless of actual architecture, disabling logging during design, assuming universal communication by default, or waiting until after an incident to define policy.

Correct Answer: If an attacker compromises one microservice and bypasses or steals valid application-layer credentials, the lack of network segmentation would allow largely unrestricted lateral movement to other services at the network layer
Explanation: Without network segmentation, a compromise that also bypasses application-layer credentials enables largely unrestricted lateral movement at the network layer, unlike assuming application-layer auth alone matches segmentation's protection, that lacking segmentation stops all services, that DNS infrastructure fails, that it reduces hosting costs, or that it has no lateral movement impact.

Correct Answer: The sensitivity of the data and functions handled by individual services, and the organization's tolerance for the operational complexity that finer-grained, per-service policy introduces
Explanation: The sensitivity of individual services' data/functions and tolerance for added operational complexity most influence segmentation granularity, which is unrelated to the dashboard's color scheme, platform team's coffee brand, headquarters parking space count, an internal newsletter's font, or outdoor temperature.

Correct Answer: Applying identity- and API-gateway-level access controls (such as scoped IAM roles and API authorization policy) tailored to the serverless execution model, since traditional pod-based NetworkPolicy constructs do not directly apply to ephemeral serverless functions
Explanation: Identity- and API-gateway-level controls tailored to the serverless model provide effective segmentation since pod-based NetworkPolicy doesn't directly apply to ephemeral functions, unlike assuming NetworkPolicy applies unmodified, leaving functions unsegmented as inherently immune, requiring conversion to persistent pods, disabling access control, or assuming no serverless-to-microservice communication occurs.

Correct Answer: Application dependency discovery to inform policy accuracy, default-deny Kubernetes NetworkPolicy rules scoped by namespace and label, and ongoing monitoring to detect policy violations or newly introduced communication flows
Explanation: Dependency discovery, default-deny NetworkPolicy scoped by namespace/label, and ongoing violation monitoring together provide effective microsegmentation, unlike a flat unenforced network, policy with no discovery validation, default-allow policy, segmentation limited to one namespace, or disabling violation monitoring.

Correct Answer: Review the NetworkPolicy's label selectors and namespace scoping to confirm the legitimate communication path was correctly and explicitly permitted, since default-deny policy requires the allowed path to be defined
Explanation: Reviewing the NetworkPolicy's label selectors and namespace scoping to confirm the legitimate path is explicitly permitted is the appropriate diagnostic step, since default-deny requires explicit allow rules, unlike blaming desktop wallpaper, removing all cluster enforcement, wrongly assuming NetworkPolicy is deprecated, blaming unrelated air conditioning, or blaming the phase of the moon.

Correct Answer: A microservices architecture decomposes functionality into many independently communicating services, dramatically increasing the number of network paths an attacker could exploit for lateral movement compared to a monolith's more limited internal communication surface
Explanation: Decomposing functionality into many communicating services dramatically increases exploitable network paths compared to a monolith's limited internal surface, unlike claiming microsegmentation and microservices are the same concept, that monoliths always have a larger surface, that this is guest-only, that microservices are inherently immune to lateral movement, or that microsegmentation eliminates the need for application-layer authentication.

Correct Answer: Continuously rediscovering service dependencies as the application changes, updating NetworkPolicy rules to reflect new or modified services, and validating in monitor mode before enforcing new policy in production
Explanation: Continuous dependency rediscovery, policy updates for new/modified services, and monitor-mode validation before production enforcement together maintain effective segmentation, unlike a set-once policy, assuming new services auto-inherit appropriate policy, skipping monitor-mode validation, annual-only review, or disabling rediscovery once initially segmented.