GIAC Security Essentials Certification (GSEC) — Question 48

With regard to defense-in-depth, which of the following statements about network design principles is correct?

Answer options

• A. A secure network design requires that systems that have access to the Internet should not be accessible from the Internet and that systems accessible from the Internet should not have access to the Internet.
• B. A secure network design requires that networks utilize VLAN (Virtual LAN) implementations to insure that private and semi-public systems are unable to reach each other without going through a firewall.
• C. A secure network design will seek to provide an effective administrative structure by providing a single choke-point for the network from which all security controls and restrictions will be enforced.
• D. A secure network design will seek to separate resources by providing a security boundary between systems that have different network security requirements.

Correct answer: D

Explanation

The correct answer, D, emphasizes the importance of creating security boundaries to protect systems with different security requirements, which is a key aspect of defense-in-depth. Options A and B misinterpret how Internet accessibility should be managed, while C incorrectly suggests a single choke-point, which can create vulnerabilities rather than enhancing security.