Certified ScrumMaster (CSM)

Correct: A multi-VPC hub-and-spoke architecture provides the highest level of isolation and risk mitigation. By separating production and development into distinct VPCs, the organization creates a hard boundary that prevents lateral movement at the network layer. A centralized transit gateway or hub allows for consistent security monitoring, deep packet inspection, and centralized policy enforcement, which aligns with internal audit requirements for robust control and visibility.

Incorrect: Increasing NACL complexity within a single VPC is prone to human error and does not provide the same level of isolation as separate VPCs. Full-mesh peering creates a complex, difficult-to-audit environment that lacks a central point of control for traffic inspection. A flat network topology is a significant security risk as it removes internal boundaries, making it easier for an attacker to move laterally across the network once an initial foothold is gained.

Takeaway: A hub-and-spoke VPC architecture enhances security and auditability by providing clear environment isolation and a centralized point for traffic inspection and policy enforcement.

Correct: WPA3-Enterprise with 802.1X authentication is the industry standard for secure corporate environments because it provides unique encryption keys for each user session and requires individual credentials. This eliminates the risks associated with shared pre-shared keys (PSKs), such as the inability to revoke access for a single user or the vulnerability to offline dictionary attacks if a single password is compromised.

Incorrect: Rotating a pre-shared key (PSK) does not address the fundamental weakness of shared credentials in a large environment. Disabling SSID broadcasting and using MAC filtering are considered ‘security by obscurity’ and are easily bypassed by attackers using basic packet sniffing and MAC spoofing tools. Captive portals provide a layer of session management but do not improve the underlying encryption or prevent unauthorized users from intercepting traffic if the wireless protocol itself is weak.

Takeaway: Enterprise-grade wireless security requires moving away from shared passwords toward individualized authentication mechanisms like 802.1X to ensure non-repudiation and strong data protection.

Correct: In a hybrid cloud environment, BGP is the standard protocol for managing dynamic routing between on-premises infrastructure and cloud providers. By using BGP on both the primary dedicated circuit and the backup VPN, the organization can use attributes like AS Path prepending to make the VPN path appear less desirable (longer) to the cloud provider. This ensures that the cloud provider prefers the dedicated circuit for return traffic, maintaining symmetric routing and predictable failover behavior.

Incorrect: Static routes with floating administrative distances are insufficient because they only react to local interface failures and cannot influence how the cloud provider routes traffic back to the on-premises environment, often leading to asymmetric routing. Spanning Tree Protocol (STP) is a Layer 2 protocol used to prevent loops in Ethernet networks and is not applicable for routing between Layer 3 environments like a data center and a cloud VPC. Layer 2 extensions (L2TP) are generally discouraged in hybrid cloud designs as they extend the broadcast domain, increasing the risk of broadcast storms and making the network less scalable and harder to troubleshoot.

Takeaway: Effective hybrid cloud connectivity requires dynamic routing protocols like BGP to manage path preference and ensure symmetrical traffic flow during failover events.

Correct: The use of industry-standard, open protocols like OSPF (Open Shortest Path First) and IEEE 802.1Q ensures that devices from different manufacturers can communicate and exchange data seamlessly. In a business continuity scenario, this allows the organization to swap hardware from different vendors without losing core functionality, thereby reducing the risk of extended downtime caused by proprietary protocol lock-in.

Incorrect: A single-vendor strategy might simplify management but increases vendor lock-in risk and does not address the immediate interoperability issues of the existing mixed environment. Increasing spare inventory addresses hardware availability but does not solve the underlying protocol incompatibility if a different model or brand must be used in an emergency. Static routing and manual assignments are highly prone to human error and lack the scalability and failover capabilities required for modern wealth management operations.

Takeaway: Adopting open-standard protocols is the most effective control for ensuring network interoperability and flexibility in multi-vendor environments.

Correct: In most network operating systems (NOS), such as Cisco IOS, configuration changes are applied immediately to the running configuration stored in volatile RAM. To ensure these changes are permanent and survive a reboot, the administrator must manually copy the running configuration to the startup configuration stored in non-volatile RAM (NVRAM). The failure to perform this step is a common cause of configuration loss during unexpected power events.

Correct: Direct Connect (or similar dedicated cloud interconnects) establishes a private, physical link between the customer’s network and the cloud provider’s edge. This bypasses the public internet entirely, providing consistent (deterministic) latency and throughput. In contrast, a Cloud VPN uses IPsec or SSL/TLS to create a secure tunnel over the public internet, which means its performance is inherently tied to the variable conditions of the internet’s routing and congestion.

Incorrect: The suggestion that Cloud VPN uses dedicated fiber while Direct Connect uses SD-WAN is a reversal of the actual technologies. The claim that Direct Connect is for client-to-site remote access is incorrect, as Direct Connect is a site-to-site/data center solution, while VPNs are more commonly used for remote access. The assertion that Cloud VPN is more secure due to Layer 2 encryption is technically inaccurate; IPsec VPNs typically operate at Layer 3, and while Direct Connect does not encrypt by default, it is considered more private because it does not traverse the public internet.

Takeaway: Direct Connect provides deterministic performance via private infrastructure, while Cloud VPN offers cost-effective, encrypted connectivity over the unpredictable public internet.

Correct: In a spine-leaf architecture, the most robust safeguard against network instability and underutilization is the use of Layer 3 routing protocols (such as OSPF or BGP) combined with Equal-Cost Multi-Pathing (ECMP). This approach allows the network to utilize all available links between the leaf and spine layers simultaneously. By operating at Layer 3, the network avoids the inherent limitations of the Spanning Tree Protocol (STP), which would otherwise block redundant paths to prevent loops, thereby ensuring faster convergence and more efficient bandwidth distribution.

Incorrect: Restricting communication to a single trunk link is incorrect because it creates a significant bottleneck and a single point of failure, defeating the purpose of the spine-leaf redundancy. Utilizing a centralized STP root bridge is a legacy approach that leads to inefficient path usage, as STP must disable redundant links to prevent loops, which is counterproductive in a fabric designed for high-capacity east-west traffic. Configuring static routes directly between leaf switches is incorrect because, in a standard spine-leaf topology, leaf switches do not have direct physical connections to one another; all inter-leaf traffic must traverse the spine layer.

Takeaway: The transition to spine-leaf architectures is best supported by Layer 3 routing and ECMP to provide non-blocking, loop-free redundancy that surpasses the limitations of traditional Layer 2 Spanning Tree Protocol.

Correct: Implementing capture filters at the point of data collection is a proactive control that prevents sensitive information from being recorded in the first place. Coupled with a time-bound deletion policy, this approach minimizes the data footprint and ensures compliance with privacy regulations by reducing the risk of long-term exposure of PII.

Incorrect: Using automated scripts instead of a GUI does not inherently address the privacy risk if the scripts are still capturing full payloads. Installing packet analysis tools on all workstations increases the attack surface and the risk of unauthorized network sniffing. Outsourcing the function does not remove the organization’s liability for data protection and may introduce additional third-party risks without solving the fundamental issue of how data is filtered and stored.

Takeaway: Internal auditors should ensure that network diagnostic procedures incorporate data minimization techniques, such as capture filters, to protect sensitive information during packet analysis.

Correct: The most effective way to manage the risk of unauthorized administrative access and ensure accountability is through the implementation of AAA (Authentication, Authorization, and Accounting). Authentication verifies the user, Authorization determines what commands they can run, and Accounting creates an audit trail of what was changed. Combining this with secure, encrypted protocols like SSH and HTTPS prevents the interception of administrative credentials in transit, which is a primary vulnerability of unencrypted protocols like Telnet or HTTP.

Incorrect: While local password policies and physical security are important, they do not address the risks associated with remote administrative access or provide the granular accountability required to track specific changes. Standard ACLs filtering ICMP traffic protect against reconnaissance but do not secure the management plane of the network operating system. Spanning Tree Protocol (STP) configurations like Root Guard are essential for Layer 2 stability and preventing man-in-the-middle attacks at the switching level, but they do not control or audit administrative access to the device’s configuration commands.

Takeaway: Securing a network operating system requires a combination of encrypted management protocols and a centralized AAA framework to ensure granular command authorization and a verifiable audit trail.