I85PREP
⌘ K
ISO 27033 Lead Manager study materials
ISO 27033 Lead Manager study resources

ISO 27033 Lead Manager practice questions

One question at a time. Build your ISO 27033 Lead Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of network security

In ISO 27033 terms, which statement best describes a 'security zone' within a network architecture?

  1. A set of user accounts that share the same password policy
  2. A list of firewall rules applied to a single router interface in a given order
  3. A physical data centre room in which all servers share one uninterruptible power supply
  4. A logical grouping of assets with common security requirements and a defined trust level, separated from other zones by controlled boundaries Correct answer.

Explanation

ISO 27033 treats a security zone as a logical grouping of assets with comparable protection needs and a common trust level. Zones are separated by controlled boundaries, typically enforcing devices, so that traffic between zones is filtered and monitored according to policy.

Question 2Fundamental concepts and principles of network security

According to ISO 27033, what is the primary purpose of a network security architecture?

  1. To replace the organisation's information security management system entirely
  2. To list the brand names of approved network hardware vendors
  3. To provide a structured framework that maps security requirements to network design and controls Correct answer.
  4. To document the physical cabling layout of every building in the organisation

Explanation

A network security architecture translates business and security requirements into a structured design of layers, zones and controls. It guides how security services are placed and managed across the network rather than cataloguing hardware or cabling.

Question 3Fundamental concepts and principles of network security

Which pair of terms does ISO 27033 use to describe the two broad approaches to securing network traffic: protecting the data itself versus protecting the path?

  1. Throughput versus latency
  2. Redundancy versus failover
  3. Authentication versus authorisation
  4. Encryption versus segmentation Correct answer.

Explanation

Network security controls broadly either protect the data through cryptography or protect the path by segmenting and controlling where traffic may flow. The two approaches are complementary and are combined in a layered architecture.

Question 4Fundamental concepts and principles of network security

What does the principle of 'least privilege' require when applied to network access control?

  1. Subjects are granted only the network access necessary for their defined tasks Correct answer.
  2. Every user receives administrator rights to avoid support tickets
  3. All internal traffic is permitted and only external traffic is filtered
  4. Access rights are granted permanently so that they never need review

Explanation

Least privilege means granting each subject only the access needed for its legitimate function, and no more. In network terms this drives granular firewall rules, per-zone permissions and periodic review of granted access.

Question 5Fundamental concepts and principles of network security

Which statement best captures the concept of 'defence in depth' in a network security architecture?

  1. Relying on a single strong perimeter firewall as the only control
  2. Deploying multiple independent layers of controls so that failure of one does not expose the assets Correct answer.
  3. Encrypting every packet twice to double the protection
  4. Removing all internal controls because the perimeter is trusted

Explanation

Defence in depth places several independent control layers so that a single failure or bypass does not lead directly to compromise. Examples include perimeter filtering, internal segmentation, host hardening and monitoring working together.

Question 6Fundamental concepts and principles of network security

What is the role of a 'buffer zone' or demilitarised zone (DMZ) in an ISO 27033 network design?

  1. To host services reachable from an untrusted network while shielding the internal trusted zones Correct answer.
  2. To provide a second authentication factor for administrators
  3. To store backup tapes in a physically separate building
  4. To accelerate traffic by caching web content for internal users

Explanation

A DMZ is an intermediate zone holding services that must be reachable from less trusted networks, such as internet-facing web servers. It isolates those services so that compromise does not give direct access to internal trusted zones.

Question 7Fundamental concepts and principles of network security

In risk terms, what does 'residual risk' mean after security controls have been implemented?

  1. The risk that is eliminated by encrypting all data at rest
  2. The risk that is transferred entirely to a third-party insurer
  3. The risk that remains once existing controls have been applied and accepted Correct answer.
  4. The risk that existed before any controls were considered

Explanation

Residual risk is what remains after controls are in place; it must be compared with the organisation's risk acceptance criteria. Management decides whether to accept, further treat, or avoid that remaining exposure.

Question 8Fundamental concepts and principles of network security

Which of the following best describes 'segmentation' as a network security principle?

  1. Assigning every device a public IP address
  2. Dividing the network into separate zones or subnets with controlled traffic between them Correct answer.
  3. Combining all servers into one flat broadcast domain for simplicity
  4. Compressing traffic to reduce bandwidth consumption

Explanation

Segmentation partitions the network into zones or subnets separated by controls, limiting how far an attacker or malware can move. It is a foundational principle for containing incidents and enforcing policy between trust levels.

Question 9Fundamental concepts and principles of network security

A company places its public web servers in one zone, its application servers in a second zone, and its database servers in a third, with firewalls between each. Which principle does this arrangement most directly implement?

  1. Load balancing for high availability
  2. Defence in depth through layered zones with controlled inter-zone traffic Correct answer.
  3. Network address translation for IPv4 conservation
  4. Single sign-on across all tiers

Explanation

Placing tiers in separate zones with filtering between them implements layered defence, so compromise of the web tier does not directly reach the database tier. Each boundary enforces policy appropriate to the trust level of the adjacent zones.

Question 10Fundamental concepts and principles of network security

An architect is defining the boundary between a corporate user zone and a server management zone. Which control placement best reflects ISO 27033 guidance on controlled boundaries?

  1. A direct layer-2 connection with no filtering to simplify administration
  2. A passive hub that broadcasts all traffic to both zones
  3. A shared administrator account used by both zones
  4. An enforcing device that filters and logs traffic crossing the boundary according to a defined policy Correct answer.

Explanation

Boundaries between zones of different trust should be enforced by a device that filters and logs traffic according to explicit policy. This makes the boundary auditable and limits unauthorised crossing between zones.

Question 11Fundamental concepts and principles of network security

Why does ISO 27033 recommend understanding data flows across the network before finalising a zone design?

  1. Because data flows are only relevant for wireless networks
  2. Because data flows determine the physical rack layout of the data centre
  3. Because data flows are needed to calculate electricity consumption
  4. Because data flows reveal which communications must be permitted, so zones and rules can be designed to allow only those flows Correct answer.

Explanation

Mapping data flows shows which systems must communicate and with what sensitivity, allowing zones and filtering rules to permit only required traffic. Without this understanding, designs either over-permit or break legitimate business functions.

Question 12Fundamental concepts and principles of network security

Which statement correctly distinguishes authentication from authorisation in network access control?

  1. Authentication applies only to devices, while authorisation applies only to users
  2. Authentication determines permissions, while authorisation verifies identity
  3. Authentication and authorisation are synonyms in network security
  4. Authentication verifies identity, while authorisation determines what an authenticated subject may do Correct answer.

Explanation

Authentication establishes who or what is requesting access, whereas authorisation decides which resources and actions are permitted once identity is established. Network access control typically applies both in sequence.

Question 13Fundamental concepts and principles of network security

An organisation wants to detect malicious traffic that has bypassed perimeter filtering. Which control type best addresses this need within a layered architecture?

  1. Increasing the perimeter firewall rule set to include every possible port
  2. Monitoring and intrusion detection sensors placed at internal zone boundaries Correct answer.
  3. Disabling logging to reduce storage costs
  4. Removing internal segmentation to simplify monitoring

Explanation

Detection of traffic that evades perimeter controls requires monitoring at internal points, such as intrusion detection sensors at zone boundaries. This complements prevention controls and supports timely incident response.

Question 14Fundamental concepts and principles of network security

What is the key security benefit of applying the 'need-to-know' principle to inter-zone firewall rules?

  1. It guarantees that no malware can ever enter the network
  2. It allows the firewall to be decommissioned once rules are minimised
  3. It removes the need for authentication within each zone
  4. It reduces the number of permitted paths an attacker can exploit between zones Correct answer.

Explanation

Restricting inter-zone rules to required flows shrinks the attack surface and limits lateral movement. Fewer permitted paths mean fewer opportunities for an adversary to pivot between zones.

Question 15Fundamental concepts and principles of network security

Which of the following is the most appropriate use of network address translation in a security architecture?

  1. Masking internal addressing from external observers while it is combined with filtering and other controls Correct answer.
  2. Replacing the need for a firewall at the internet boundary
  3. Providing authentication of remote users
  4. Encrypting traffic between internal zones

Explanation

NAT can hide internal addressing from external parties, but it is a supporting measure and must be combined with filtering and monitoring. Alone it is not a security control and cannot replace a firewall.

Question 16Fundamental concepts and principles of network security

A design team proposes connecting a partner network directly to an internal server zone without filtering, arguing that the partner is contractually trusted. Which ISO 27033 principle does this most clearly violate?

  1. Applying load balancing across server tiers
  2. Using dynamic routing protocols internally
  3. Documenting the network topology in an inventory
  4. Treating external networks as untrusted and enforcing a controlled boundary between zones Correct answer.

Explanation

ISO 27033 assumes external parties, including partners, are not inherently trusted and require a controlled boundary. Contractual trust does not remove the need for filtering, monitoring and least-privilege connectivity.

Question 17Fundamental concepts and principles of network security

Which statement best describes the relationship between an ISMS and a network security architecture under ISO 27033?

  1. The two are unrelated and developed independently
  2. The architecture implements and is governed by the ISMS risk-management framework Correct answer.
  3. The architecture replaces the ISMS for all technical matters
  4. The ISMS is only relevant to physical security, not networks

Explanation

The ISMS provides the risk-management framework, policies and objectives that the network security architecture must satisfy. The architecture is a technical realisation of the ISMS requirements, not a substitute for it.

Question 18Fundamental concepts and principles of network security

What is the purpose of defining 'security services' such as confidentiality, integrity and availability in a network architecture?

  1. To record the names of staff responsible for patching
  2. To describe the physical security of network cabinets
  3. To list the software licences required for each network device
  4. To state what protection the network must deliver so that controls can be selected and verified against those objectives Correct answer.

Explanation

Security services express the protection objectives the network must provide, guiding control selection and later verification. They give architects a basis for testing whether the design actually meets requirements.

Question 19Fundamental concepts and principles of network security

An organisation must choose between a flat internal network and a segmented design with equal budget. Which argument most strongly favours segmentation from an ISO 27033 perspective?

  1. Segmentation limits the scope and speed of lateral movement after a compromise Correct answer.
  2. Segmentation removes the need for endpoint protection
  3. Segmentation eliminates the requirement for user awareness training
  4. Segmentation guarantees that no host will ever be infected

Explanation

Segmentation contains incidents by restricting how far an attacker can move and how quickly, reducing overall impact. It complements but does not replace endpoint protection or user awareness, and cannot guarantee that no host is infected.

Question 20Fundamental concepts and principles of network security

Which scenario best illustrates the principle of 'fail secure' in network security design?

  1. A switch that broadcasts frames when its MAC table overflows
  2. A firewall that disables its rules during maintenance windows
  3. A gateway that blocks all traffic when its policy engine fails, rather than allowing everything Correct answer.
  4. A gateway that forwards all traffic when its logging service is unavailable

Explanation

Fail secure means a control defaults to denying or blocking when it fails, preserving protection. Allowing all traffic on failure would be fail open and could expose the protected zone.

Question 21Fundamental concepts and principles of network security

A risk assessment shows a high-value database zone reachable from many internal subnets. Which design change best aligns with ISO 27033 principles without breaking required business flows?

  1. Encrypt database traffic while leaving all access paths unchanged
  2. Allow all internal subnets to reach the database but add a second firewall behind it
  3. Collapse the database zone into the general user subnet to simplify routing
  4. Restrict access to the database zone to only the application tier flows that require it, with logging at the boundary Correct answer.

Explanation

The principle is to permit only the flows the business requires and to enforce and log them at the zone boundary. This reduces exposure while preserving legitimate application-tier access.

Question 22Fundamental concepts and principles of network security

An architect argues that because all internal users are employees, the internal network can be treated as a single trusted zone. Which criticism is most consistent with ISO 27033?

  1. Trust should be based on required access and asset sensitivity, not merely on employment status, so internal segmentation is still needed Correct answer.
  2. The argument is correct because employees never introduce malware
  3. The argument is correct provided all employees use antivirus software
  4. The argument is correct only if the perimeter firewall is from a certified vendor

Explanation

ISO 27033 rejects the assumption that internal networks are uniformly trusted; trust derives from access needs and asset sensitivity. Insider threats, compromised endpoints and malware all justify internal segmentation regardless of employment status.

Question 23Fundamental concepts and principles of network security

When two zones require different protection levels but must exchange data, what does ISO 27033 suggest about the boundary control?

  1. It should be removed so that the two zones merge into one trust level
  2. It should enforce the stricter policy for the protected zone while permitting only the specific required flows Correct answer.
  3. It should apply the looser policy so that data exchange is never interrupted
  4. It should rely solely on the honour system between administrators

Explanation

Where zones of differing sensitivity interact, the boundary must protect the more sensitive zone and allow only the specific flows needed. The stricter policy governs because the higher-value assets require the stronger protection.

Question 24Fundamental concepts and principles of network security

A design includes both preventive controls at zone boundaries and detective controls inside zones. Which statement best explains why both are needed rather than prevention alone?

  1. Detection controls replace the need for logging
  2. Prevention controls are only useful for external traffic
  3. Detection controls make prevention controls unnecessary
  4. Prevention can be bypassed or misconfigured, so detection provides the visibility needed to identify and respond to what gets through Correct answer.

Explanation

Preventive controls reduce the likelihood of compromise but cannot be assumed perfect; misconfiguration and novel attacks can bypass them. Detective controls provide visibility so that incidents that slip through are identified and handled.

Question 25Fundamental concepts and principles of network security

Which statement best explains why a network security architecture should be reviewed when business services or threats change?

  1. Because the zone design and controls were derived from specific requirements and risk assumptions that may no longer hold Correct answer.
  2. Because networks become inherently insecure after a fixed number of years
  3. Because review is required only to satisfy auditors, with no security effect
  4. Because hardware warranties expire and force redesign

Explanation

The architecture encodes assumptions about services, data flows and threats; when those change, the controls may no longer match the risk. Periodic review keeps the design aligned with current requirements and the threat landscape.

Question 26Fundamental concepts and principles of network security

In ISO 27033 terminology, what does a 'security zone' represent within a network architecture?

  1. A physical data centre room whose access is controlled by badge readers
  2. A list of firewall rules applied to a single router interface
  3. A backup site kept synchronised with the production network
  4. A logical grouping of network assets that share the same protection requirements and trust level Correct answer.

Explanation

ISO 27033 treats a security zone as a logical construct that groups assets with common protection needs and a common trust level, so that controls can be applied consistently at its boundary. Zones are defined by security requirements rather than by physical location or by the configuration syntax of one device.

Question 27Fundamental concepts and principles of network security

Which term describes the point at which traffic passes between two security zones and where controls are enforced?

  1. The collision domain
  2. The routing table
  3. The security boundary Correct answer.
  4. The subnet mask

Explanation

A security boundary is the interface between zones of differing trust where the architecture places enforcement controls such as filtering, inspection or authentication. Identifying boundaries explicitly is a core step in ISO 27033 because controls are positioned relative to them.

Question 28Fundamental concepts and principles of network security

An architect is documenting the protection needs of a new network. Which pairing correctly matches an ISO 27033 security service with a network control that supports it?

  1. Non-repudiation - assigning static IP addresses to servers
  2. Integrity - hiding the internal IP addressing scheme
  3. Confidentiality - encrypting traffic on links that cross untrusted networks Correct answer.
  4. Availability - hashing stored configuration files

Explanation

Encryption on untrusted links directly supports confidentiality by preventing disclosure to parties on the path. The other pairings misattribute the service that the named control actually provides.

Question 29Fundamental concepts and principles of network security

What is the primary purpose of a network security architecture as described in ISO 27033?

  1. To replace the organisation's risk assessment process with a fixed technical baseline
  2. To document the cabling topology of each building
  3. To translate business and risk requirements into a structured set of network security controls and their placement Correct answer.
  4. To specify the brand of firewalls an organisation must purchase

Explanation

The architecture connects business drivers and risk treatment decisions to concrete control choices and their positioning in the network. It complements rather than replaces risk assessment and is vendor-neutral.

Question 30Fundamental concepts and principles of network security

Which concept describes the assumption that no single control will fail-safe forever, so multiple overlapping controls are arranged so that a weakness in one is covered by another?

  1. Defence in depth Correct answer.
  2. Quality of service
  3. Single sign-on
  4. Address aggregation

Explanation

Defence in depth layers independent controls so that bypass or failure of one layer does not leave the asset unprotected. ISO 27033 uses this principle to justify combining boundary filtering, internal monitoring and host hardening.

Question 31Fundamental concepts and principles of network security

In network security terms, what does 'attack surface' refer to?

  1. The set of exposed interfaces, services and entry points through which an adversary could attempt to interact with the system Correct answer.
  2. The physical perimeter fence surrounding a data centre
  3. The volume of log data generated per day by security devices
  4. The number of administrators holding privileged accounts

Explanation

The attack surface is the sum of reachable entry points an attacker can probe, so reducing exposed services and interfaces shrinks it. ISO 27033 design guidance favours minimising reachable services to limit exploitable pathways.

Question 32Fundamental concepts and principles of network security

Which statement best captures the difference between a threat and a vulnerability in network security risk analysis?

  1. A threat is a potential cause of an incident, while a vulnerability is a weakness that the threat could exploit Correct answer.
  2. A threat is measured in currency, while a vulnerability is measured in time
  3. A threat is always internal, while a vulnerability is always external
  4. A threat is a weakness in code, while a vulnerability is an attacker's motivation

Explanation

Threats are potential causes of harm such as an adversary or a flooding event, whereas vulnerabilities are weaknesses in assets or controls that a threat can act upon. ISO 27033 risk thinking combines the two with impact to prioritise controls.

Question 33Fundamental concepts and principles of network security

Why does ISO 27033 emphasise identifying assets and their value early in the architecture lifecycle?

  1. Because asset identification automatically eliminates all vulnerabilities
  2. Because protection requirements and zone placement decisions derive from what must be protected and how much harm its loss would cause Correct answer.
  3. Because asset registers are required for software licence reconciliation
  4. Because asset counts determine the maximum permitted firewall rule count

Explanation

Knowing which assets exist and their value allows the architect to derive protection requirements and place assets into appropriate zones. Without that basis, control selection becomes arbitrary rather than risk-driven.

Question 34Fundamental concepts and principles of network security

An organisation runs a single flat network segment on which workstations, payroll servers and an internet-facing web server all reside. Which principle does this design most clearly violate?

  1. Data minimisation, because too few hosts are retained
  2. Availability, because no backup power exists
  3. Least privilege applied to network paths, because every host can reach every other host Correct answer.
  4. Non-repudiation, because users are not individually identified

Explanation

Placing assets of very different sensitivity on one segment lets any compromised host reach the others, breaching the principle that network paths should grant only the access required. Segmentation and filtering would confine each asset to its necessary communications.

Question 35Fundamental concepts and principles of network security

A team proposes allowing all outbound traffic from the internal zone to any internet destination because 'outbound is harmless'. Which counter-argument is most consistent with ISO 27033 principles?

  1. Compromised internal hosts use outbound channels for command and control and data exfiltration, so outbound flows also need restriction and monitoring Correct answer.
  2. Outbound traffic cannot be logged by boundary devices and is therefore irrelevant
  3. Outbound traffic consumes more bandwidth than inbound traffic and must be throttled
  4. Outbound filtering is only needed when the organisation has no intrusion detection system

Explanation

Unrestricted egress gives malware a reliable path to external controllers and a route for stolen data, so egress filtering and monitoring are part of a sound boundary design. The principle is that trust should not be granted purely on the direction of a flow.

Question 36Fundamental concepts and principles of network security

A security architect must decide where to terminate remote-access VPN sessions for employees. Which placement best follows zone-based design reasoning?

  1. Terminate directly on a core internal switch so that authenticated users bypass all filtering
  2. Terminate on an employee workstation so that each user manages their own tunnel
  3. Terminate on the database server so that sessions are closest to the data
  4. Terminate in a dedicated remote-access zone that is filtered both toward the internet and toward internal zones Correct answer.

Explanation

A dedicated remote-access zone lets the architecture apply distinct policy to untrusted incoming sessions and then filter onward access to internal zones. This keeps authenticated-but-external traffic from being treated as fully trusted.

Question 37Fundamental concepts and principles of network security

Which statement best explains why ISO 27033 treats 'trust' as a relative rather than absolute property of a zone?

  1. Trust can be purchased through certification, after which no further controls are needed
  2. Trust applies only to external partners and never to internal employee zones
  3. Trust is absolute once multi-factor authentication is deployed at the boundary
  4. Trust reflects the degree of confidence in the behaviour of users and systems in a zone, and it can degrade, so controls must not rely on it permanently Correct answer.

Explanation

Trust levels express confidence, and that confidence can be undermined by compromise, misconfiguration or insider action. Designs therefore keep controls in place between zones even where trust is currently high.

Question 38Fundamental concepts and principles of network security

An organisation must protect a network that carries both office productivity traffic and industrial control traffic. Which design decision best reflects ISO 27033 guidance?

  1. Give the industrial devices priority routing so that productivity traffic cannot delay them
  2. Rely on the fact that industrial protocols are obscure and therefore not targeted
  3. Separate the two into distinct zones with a controlled boundary, because their protection requirements and failure consequences differ Correct answer.
  4. Merge them into one zone to simplify monitoring and reduce cabling

Explanation

Different protection requirements and different consequences of failure justify separate zones with an explicit boundary between them. This limits the chance that a compromise or traffic surge in one environment harms the other.

Question 39Fundamental concepts and principles of network security

What is the security significance of a 'choke point' in a network security architecture?

  1. It removes the need for logging because all traffic is trusted at that point
  2. It guarantees availability by duplicating every link
  3. It concentrates traffic through a controlled location where policy can be enforced and monitored consistently Correct answer.
  4. It increases throughput by allowing parallel uncontrolled paths

Explanation

Deliberately funnelling inter-zone traffic through a controlled point makes enforcement and monitoring tractable and avoids uncontrolled alternate paths. The risk to manage is that the choke point itself must be resilient so it does not become a single point of failure.

Question 40Fundamental concepts and principles of network security

A design review finds that a firewall rule set permits any source to reach a management interface on port 22. Which change best aligns the design with least-privilege network principles?

  1. Restrict the rule to the specific management hosts and administrative subnet that require access, and log the permitted sessions Correct answer.
  2. Change the management port to a non-standard number and keep the rule open to any source
  3. Remove logging on the rule to reduce storage costs
  4. Add a second identical rule so that access is faster

Explanation

Least privilege means permitting only the identified sources that genuinely need management access, and retaining logging so that permitted use is auditable. Port obfuscation does not restrict who may connect.

Question 41Fundamental concepts and principles of network security

Which statement best describes the role of 'security requirements' derived from business services in an ISO 27033 architecture?

  1. They list the hardware models approved for procurement
  2. They replace the need for a documented network topology
  3. They define what the network must protect and to what degree, and thereby constrain acceptable design options Correct answer.
  4. They describe the physical layout of server racks

Explanation

Business-derived security requirements state the protection objectives and acceptable risk, which then constrain which designs are acceptable. They are inputs to design decisions rather than procurement or facilities lists.

Question 42Fundamental concepts and principles of network security

An architect is choosing between terminating all inter-zone traffic at one high-capacity firewall and using several smaller firewalls per zone pair. Which consideration is most relevant to the ISO 27033 principle of avoiding single points of failure?

  1. Several smaller firewalls eliminate the need for a security boundary policy
  2. Device count has no bearing on availability or on control integrity
  3. The single device is always preferable because fewer devices means fewer rules to write
  4. A single enforcement device must be made resilient, otherwise its failure either halts business traffic or forces bypass of the control Correct answer.

Explanation

Concentrating enforcement at one device improves consistency but creates a failure dependency, so redundancy and tested failover are needed to avoid either outage or emergency bypass. The architecture must reconcile enforcement consistency with resilience.

Question 43Fundamental concepts and principles of network security

What does ISO 27033 mean by describing network security architecture as 'layered' across an organisation's technical, procedural and organisational measures?

  1. Layering refers only to the OSI model's seven protocol layers
  2. Only the technical layer matters because procedures cannot stop attacks
  3. Technical controls are complemented by documented procedures and assigned responsibilities so that controls are operated and maintained, not merely installed Correct answer.
  4. Each layer must use a different firewall vendor to be independent

Explanation

A layered architecture recognises that technical enforcement depends on procedures such as change control, monitoring and incident response, and on clear ownership. Controls that are installed but unoperated decay quickly.

Question 44Fundamental concepts and principles of network security

A new application will exchange session data with a partner over the internet. Which requirement should the architecture impose on the inter-organisational connection?

  1. Direct routing between the two internal address spaces with no filtering to reduce latency
  2. Reliance on the partner's assertion that their network is secure
  3. Use of a shared flat VLAN spanning both organisations for simpler addressing
  4. A defined boundary with authenticated, encrypted and filtered exchange limited to the specific service and endpoints required Correct answer.

Explanation

Inter-organisational connections are boundaries between different trust domains, so the architecture should specify authentication, encryption and filtering limited to the required service. Assurances from the partner do not replace enforced controls on the path.

Question 45Fundamental concepts and principles of network security

Which statement best explains why ISO 27033 distinguishes between 'logical' and 'physical' network security architecture?

  1. The two are identical and the distinction exists only for documentation style
  2. Physical architecture concerns only aesthetic cabling standards
  3. Logical architecture is a draft that is discarded once physical cabling is installed
  4. Logical architecture addresses zoning, addressing and control placement, while physical architecture addresses the resilience and separation of the underlying links and facilities Correct answer.

Explanation

The logical view captures zones, flows and control placement independent of equipment, while the physical view captures link diversity, facility separation and resilience. Both must be consistent for the design to hold under failure or physical intrusion.

Question 46Fundamental concepts and principles of network security

An organisation discovers that a legacy application requires a protocol that its boundary firewall cannot inspect. Which response is most consistent with ISO 27033 risk-based design?

  1. Disable all monitoring on that path to avoid false alarms
  2. Document the residual exposure, compensate with controls such as strict source restriction and network monitoring, and plan a migration path Correct answer.
  3. Open the protocol fully and accept the risk without documentation because the application is legacy
  4. Assume the firewall's default policy will handle the protocol adequately

Explanation

When a required protocol cannot be inspected, the architect records the exposure and adds compensating controls such as narrow source restrictions and monitoring, while planning to remove the constraint. Silent acceptance without documentation leaves the risk unmanaged and invisible.

Question 47Fundamental concepts and principles of network security

Two business units each propose a different zone model for the same network. Which approach best reflects ISO 27033 architecture governance?

  1. Evaluate both models against documented security requirements and risk criteria, and record the rationale for the chosen design and its accepted trade-offs Correct answer.
  2. Adopt whichever model the larger business unit prefers to avoid escalation
  3. Defer the decision indefinitely until the technology refresh cycle
  4. Implement both models simultaneously on the same infrastructure

Explanation

Architecture governance resolves design conflicts by evaluating options against agreed requirements and risk criteria, and by documenting the decision and its trade-offs. This preserves traceability for later review and audit.

Question 48Fundamental concepts and principles of network security

A penetration test shows that an attacker who compromises a web server can reach the internal application tier directly. Which architectural weakness does this most directly indicate?

  1. Overuse of multi-factor authentication for administrators
  2. Insufficient enforcement at the boundary between the web tier and the application tier, allowing lateral movement beyond the intended path Correct answer.
  3. Excessive encryption of the web tier's outbound traffic
  4. Inadequate physical security of the web server room

Explanation

The finding shows that a compromised host can traverse a boundary that should have permitted only the required service flows. The corrective focus is the inter-tier boundary policy and the restriction of lateral paths, not unrelated controls.

Question 49Fundamental concepts and principles of network security

An architect asserts that because a zone uses strong authentication for every connection, it needs no internal monitoring. Which evaluation is most defensible under ISO 27033?

  1. The assertion is sound provided the authentication uses certificates rather than passwords
  2. The assertion is sound because authentication makes insider misuse impossible
  3. The assertion is weak only if the zone contains internet-facing servers
  4. The assertion is weak because authentication controls who may connect, not whether an authenticated party is behaving maliciously, so monitoring remains necessary Correct answer.

Explanation

Authentication establishes identity but does not constrain what an authenticated party does after connecting, and credentials can be stolen. Detection controls inside the zone remain necessary to identify misuse or compromise.

Question 50Fundamental concepts and principles of network security

A design team wants to reduce the number of zones to simplify operations. Which consequence should the architect highlight as the most significant security trade-off?

  1. Fewer zones widen the reachable set from any single compromised host and reduce the granularity of policy enforcement Correct answer.
  2. Fewer zones eliminate the need for a risk assessment
  3. Fewer zones automatically increase the strength of encryption between remaining zones
  4. Fewer zones guarantee lower latency for all applications

Explanation

Consolidating zones enlarges each trust domain, so a compromise grants broader reach and boundary policy becomes coarser. Operational simplicity is a legitimate goal but must be weighed against this loss of containment and granularity.