3.2 Given a scenario, apply security principles to secure enterprise infrastructure

Domain 3: Security Architecture

This scenario objective is about placing and choosing infrastructure controls. Know device placement and security zones, attack surface, connectivity, and failure modes (fail-open versus fail-closed). Compare device attributes: active versus passive, inline versus tap or monitor. Cover network appliances — jump servers, proxy servers, IPS versus IDS, load balancers, sensors — plus port security (802.1X, EAP), firewall types (WAF, UTM, NGFW, layer 4 versus layer 7), and secure communications: VPN, remote access, tunneling with TLS or IPSec, SD-WAN, and SASE. Selection of effective controls ties it together. The exam wants placement logic: an IPS must sit inline to block; an IDS on a tap only alerts; a jump server brokers admin access into a secure zone; a WAF protects web applications at layer 7. Expect a fail-open versus fail-closed question framed around whether availability or security matters more for the described system.

What you must know

common pitfall · Candidates choose an IDS when the scenario requires blocking traffic, forgetting that only an inline IPS can prevent rather than just detect.

Try sample questions

A hospital is adding network-connected infusion pumps that cannot run endpoint security agents. The security architect must limit the impact of a compromised pump while keeping every device reachable by the clinical management server. Which two design choices best meet this goal? (Select TWO.)

  • A Assign the pumps to the same VLAN as staff workstations to simplify traffic monitoring
  • B Place the pumps in a dedicated segment with firewall rules allowing traffic only to the management server
  • C Install host-based intrusion prevention software on each infusion pump
  • D Require 802.1X with device certificates so only authorized pumps can join the segment
  • E Publish the pump management interface to the internet so the vendor can patch it remotely
Show answer & explanations
  • A Mixing unmanaged medical devices with staff workstations lets a compromised pump reach user endpoints directly, which is exactly the lateral movement the architect is trying to prevent.
  • B correct ·Correct. A dedicated segment with firewall rules limited to the management server contains a compromised pump, preventing it from reaching other clinical systems or the general hospital network.
  • C The scenario states the pumps cannot run endpoint security agents, so host-based intrusion prevention software cannot be installed on them regardless of its potential benefit.
  • D correct ·Correct. Certificate-based 802.1X authentication ensures a rogue or spoofed device cannot simply plug into the pump segment, enforcing that only authorized pumps ever join that network.
  • E Publishing the management interface to the internet exposes life-critical devices to worldwide attackers; vendor patching should occur through controlled channels such as a monitored VPN instead.

sample item — the full bank runs 450+ questions at exam difficulty

Administrators at a logistics company currently open RDP sessions directly from their everyday office workstations to servers in a screened subnet. A recent assessment flagged this practice as a serious weakness. Which change best applies secure infrastructure design principles to administrative access?

  • A Deploy a hardened jump server in a management zone as the only permitted source for administrative sessions
  • B Require administrators to use significantly longer passwords for their existing direct RDP connections
  • C Move the servers into the same VLAN as the workstations to simplify the firewall rule set
  • D Open the servers' RDP ports on the perimeter firewall and restrict connections with geo-IP filtering
Show answer & explanations
  • A correct ·Correct. A hardened jump server concentrates administrative access through a single monitored, tightly controlled host, letting firewall rules block direct sessions from general-purpose workstations that may be compromised.
  • B Longer passwords slightly strengthen authentication but leave the underlying design flaw intact: everyday workstations exposed to email and web browsing can still reach the servers directly.
  • C Flattening the network by merging VLANs removes segmentation entirely, expanding the attack surface instead of restricting the paths an attacker could take to reach the servers.
  • D Exposing RDP through the perimeter firewall increases risk dramatically; geo-IP filtering is easily bypassed with proxies and does nothing to authenticate or isolate administrative sessions.

Is objective 3.2 your weak spot?

The free readiness check finds your weakest objectives in 15 adaptive questions — then full access drills them until the gauge clears the cut line.

Check my readiness — free