22 Network Architecture & Cloud Security Practice Questions & Answers

Every Network Architecture & Cloud Security practice question from the ISC2 Certified in Cybersecurity (CC) Practice Test, with the correct answer and a short explanation.

Start practice test →

1. An organization divides its network into separate segments and filters the traffic that passes between them. At the concept level, what does this segmentation mainly limit?
- A.It limits how far an intruder who compromises one host can reach into the other segments✓ Answer
- B.It encrypts every packet that crosses the boundary from one segment into another segment
- C.It removes the need to patch the operating systems of the hosts placed inside a segment
- D.It guarantees that malicious software cannot run on any host that sits inside a segment
Segmentation works by forcing traffic between groups of systems through a filtering point, so a compromise is confined to the segment where it started instead of spreading freely. It does not encrypt traffic, patch hosts, or stop code from executing; those are separate controls.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — understand network security architecture — network segmentationReport a problem with this question
2. A small company runs one flat network: every workstation, server, printer and camera shares a single segment with no filtering between devices. Why is that arrangement considered dangerous?
- A.A flat network blocks encrypted sessions, so applications are forced to fall back to cleartext ones
- B.A flat network cannot hand out addresses automatically, so each device has to be configured by hand
- C.A flat network cannot resolve names to addresses, so every server must be contacted by its address
- D.A flat network lets one compromised device reach every other device, so an infection spreads unchecked✓ Answer
With no internal boundary, any host that an attacker takes over has an unobstructed path to every other host, so a single foothold becomes access to the whole estate. Address assignment, name resolution and encryption are unrelated to whether a network is segmented.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — network segmentation and defense in depthReport a problem with this question
3. An administrator claims that putting guest devices in their own VLAN isolates them completely and therefore forms a full security boundary. Which statement corrects that claim?
- A.VLANs divide a network physically, so two VLANs can never share one switch or one uplink cable
- B.VLANs encrypt frames as they leave the switch, so their strength depends on the cipher selected
- C.VLANs work at Layer 3, so traffic passing between two of them is filtered by firewall rules by default
- D.VLANs separate traffic only logically, and VLAN hopping can defeat them, so they are one control✓ Answer
A VLAN is a software-created Layer 2 separation on shared switching hardware; because the separation is a tag rather than a physical break, techniques such as VLAN hopping can expose traffic from another VLAN. VLANs are therefore a useful segmentation tool, not a guaranteed security boundary on their own.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — VLANs; IEEE 802.1Q VLAN tagging on Ethernet framesReport a problem with this question
4. A data centre team applies filtering policy at almost every connection point so that each workload can communicate only with the specific workloads it needs. Which concept is this, and what traffic is it aimed at?
- A.Defence in depth, aimed at layering administrative, technical and physical controls across the site
- B.A screened subnet, aimed at the inbound traffic that arrives from the internet toward public servers
- C.Micro-segmentation, aimed at the east-west traffic that moves between systems inside the data centre✓ Answer
- D.Network access control, aimed at checking each device's posture at the moment it joins the network
Micro-segmentation places internal perimeters at nearly every connection point so that lateral, server-to-server movement inside the data centre must pass policy, which is exactly what a perimeter-only design cannot inspect. A screened subnet governs inbound internet traffic, not this internal east-west flow.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — micro-segmentation; NIST SP 800-207, Zero Trust Architecture (micro-segmentation approach)Report a problem with this question
5. A firewall groups its interfaces into zones — untrusted, screened subnet and internal — and rules are written between those zones. What is the principle behind organizing a firewall this way?
- A.Systems are grouped by physical building, and traffic between buildings is allowed unless a rule denies it
- B.Systems are grouped by trust level, and traffic between groups is denied unless a rule explicitly permits it✓ Answer
- C.Systems are grouped by bandwidth demand, and traffic between groups is shaped rather than filtered by rule
- D.Systems are grouped by operating system, and traffic between platforms is scanned only for known malware
Zones exist so that interfaces of comparable trust share one policy, and the firewall then evaluates every crossing between zones against an explicit rule set under a default-deny posture. Grouping by building, platform or bandwidth would not express any trust relationship for the rules to enforce.
Source: NIST SP 800-41, Guidelines on Firewalls and Firewall Policy (firewall policy and network zones); ISC2 CC Exam Outline, Networking and Cloud Security Concepts — firewall zonesReport a problem with this question
6. An organization puts its public-facing servers in a screened subnet, often called a DMZ. What does that design achieve, and what does it deliberately avoid?
- A.Outside users reach the published servers, and internal file servers are moved into the same subnet for simpler rules
- B.Outside users reach the published servers, but those servers receive no unrestricted path into the internal network✓ Answer
- C.Outside users are kept away from the published servers, and only staff arriving through a tunnel may use them
- D.Outside users reach the published servers, and those servers then need no patching because the firewall shields them
A screened subnet is a separately filtered zone that is deliberately reachable from the outside while a second set of rules stops its hosts from initiating unrestricted traffic inward, so a compromised public server does not become a doorway into the private network. Hosts in the zone still require full patching and hardening.
Source: NIST SP 800-41, Guidelines on Firewalls and Firewall Policy (demilitarized zone / screened subnet design)Report a problem with this question
7. Which statement best describes defence in depth as a design principle?
- A.Independent controls of different kinds are layered, so the failure of one does not expose the asset✓ Answer
- B.Identical controls are duplicated at the same point, so that capacity doubles whenever demand rises
- C.One very strong control is chosen for the perimeter, so that weaker internal controls become unnecessary
- D.Controls are applied only to the most critical assets, so that spending stays concentrated where it counts
Defence in depth works because the layers are independent and of different kinds — administrative, technical and physical — so a weakness that defeats one layer is unlikely to defeat the next. Duplicating the same control at the same point adds capacity, not depth, since one flaw would defeat both copies.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — Defense in depth; NIST SP 800-160 Vol. 1, security design principle of defense in depthReport a problem with this question
8. A company's whole security design is one internet firewall: hosts run no endpoint protection, there is no internal filtering, and staff receive no security training. Which criticism is most accurate?
- A.The design has only one layer, so anything that gets past the firewall meets no further obstacle✓ Answer
- B.The design has too many layers, so alerts from overlapping controls will swamp the small support team
- C.The design rests on physical controls, so it protects equipment but leaves stored records unprotected
- D.The design uses only administrative controls, so it states expectations but enforces none of them
Everything described sits at a single perimeter point, so the architecture has one layer and no depth: a phishing message, a contractor's laptop or any traffic that the firewall permits lands in an environment with nothing else to stop it. A firewall is a technical control, so the design is neither physical nor administrative in nature.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — Defense in depth — layered controlsReport a problem with this question
9. A reviewer notes that an organization's protective layers consist entirely of technical products. Which addition best extends defence in depth?
- A.A second brand of firewall installed directly behind the first one at the same perimeter link
- B.A faster internet circuit so the inspection devices never become a bottleneck during busy periods
- C.A longer log retention window so that stored evidence covers more time after any given incident
- D.A policy and awareness programme for staff, plus physical layers such as locks on equipment rooms✓ Answer
Defence in depth is defined across control types, not only across devices, so the gap in an all-technical stack is filled by administrative controls such as policy and training and by physical controls such as locked equipment rooms. Adding another appliance at the same perimeter link leaves the same single point of reliance.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — Defense in depth spans administrative, technical and physical controlsReport a problem with this question
10. Which assumption does a zero trust approach deliberately abandon?
- A.That the identity of a user must be proved before an account is granted access to a resource
- B.That users and traffic that are already inside the network perimeter can be treated as trustworthy✓ Answer
- C.That sensitive information must be encrypted whenever it travels across a public network
- D.That administrative actions must be logged so that they can be reviewed and investigated later
Zero trust starts from the premise that the internal network is hostile, which removes the implicit trust a perimeter model grants to anything already inside. The other three assumptions are ordinary good practice that zero trust keeps and in fact leans on more heavily.
Source: NIST SP 800-207, Zero Trust Architecture (tenets — no implicit trust based on network location)Report a problem with this question
11. Under zero trust, a user who authenticated an hour ago now asks for a different internal application. What does the model require?
- A.The request is allowed, because the earlier authentication covers the whole internal network that day
- B.The request is allowed, because the user's device holds an address inside the trusted internal range
- C.The request is held until an administrator manually approves the user for the new application
- D.The request is authenticated and authorized again against policy before that resource is opened✓ Answer
In zero trust, access is granted per session and per resource, so each new request is evaluated against policy rather than inheriting trust from an earlier login or from the address the device holds. The re-evaluation is automatic policy enforcement, not a manual approval queue.
Source: NIST SP 800-207, Zero Trust Architecture (access granted on a per-session basis, evaluated per request)Report a problem with this question
12. How does zero trust differ from micro-segmentation, even though organizations often deploy the two together?
- A.Zero trust applies only to workloads in the cloud, while micro-segmentation applies only to on-premises equipment
- B.Zero trust centres protection on the outer perimeter, while micro-segmentation does away with perimeters entirely
- C.Zero trust centres protection on assets, identities and data, while micro-segmentation adds internal perimeters✓ Answer
- D.Zero trust replaces authentication with monitoring, while micro-segmentation replaces filtering with encryption
Micro-segmentation is a network technique: it multiplies internal perimeters so lateral movement must cross policy. Zero trust is broader — it moves the decision point to the subject, the asset and the data, verifying each request, which is why it is often described as building better gates rather than higher walls.
Source: NIST SP 800-207, Zero Trust Architecture (micro-segmentation as one deployment approach; protection focused on resources)Report a problem with this question
13. A developer adds extra storage capacity through a provider portal within minutes and never speaks to anyone at the provider. Which essential cloud characteristic does this illustrate?
- A.Rapid elasticity, because capacity expands and contracts as the workload rises and falls over time
- B.Resource pooling, because the capacity is drawn from hardware that is shared among many tenants
- C.On-demand self-service, because capacity is obtained with no human interaction at the provider✓ Answer
- D.Measured service, because the capacity consumed is metered and billed by the amount used
The defining detail is that the consumer provisions the capability unilaterally, without human interaction with the service provider; that is precisely what on-demand self-service names. Elasticity describes scaling to match load, and measured service describes metering, neither of which is what the scenario emphasises.
Source: NIST SP 800-145, The NIST Definition of Cloud Computing (essential characteristic: on-demand self-service)Report a problem with this question
14. Virtual machines belonging to several unrelated customers run on the same physical hosts, and the provider reassigns capacity among them according to demand. Which essential characteristic is this?
- A.Broad network access, because those shared hosts are reachable from many kinds of client devices
- B.Measured service, because the provider counts how much of the shared capacity each customer has used
- C.On-demand self-service, because the customers request that shared capacity through a portal themselves
- D.Resource pooling, because one shared pool serves multiple tenants with dynamically assigned resources✓ Answer
Resource pooling is the multi-tenant model in which physical and virtual resources are pooled and dynamically assigned and reassigned according to consumer demand, which is exactly the behaviour described. Metering and self-service may also be present, but neither explains why unrelated customers share the same hosts.
Source: NIST SP 800-145, The NIST Definition of Cloud Computing (essential characteristic: resource pooling / multi-tenant model)Report a problem with this question
15. Staff open the same hosted application from company laptops, personal tablets and phones over ordinary network connections. Which essential characteristic does this describe?
- A.Broad network access, because the service is reachable over the network from standard client platforms✓ Answer
- B.Rapid elasticity, because the service adjusts its capacity to the number of clients that connect to it
- C.Resource pooling, because those clients are served from hardware that is shared among many tenants
- D.On-demand self-service, because those clients obtain their own access without the provider's help
Broad network access means capabilities are available over the network and reached through standard mechanisms that work on heterogeneous thin and thick client platforms, which is what the mix of laptops, tablets and phones demonstrates. Nothing in the scenario says capacity changed or that billing was metered.
Source: NIST SP 800-145, The NIST Definition of Cloud Computing (essential characteristic: broad network access)Report a problem with this question
16. A development team wants to write, test and deploy its own application while the provider supplies and maintains the operating system, runtime and hardware underneath it. Which service model fits?
- A.Infrastructure as a Service, where the customer installs and maintains the operating system itself
- B.Platform as a Service, where the customer manages its own application and data on a kept-up platform✓ Answer
- C.Software as a Service, where the customer only uses a finished application supplied by the provider
- D.A private deployment, where the customer owns and maintains the whole stack for its exclusive use
In Platform as a Service the consumer deploys applications it has created onto provider-managed infrastructure: it does not control the network, servers, operating systems or storage, but it does control the deployed application and its configuration. IaaS would leave the operating system to the customer, and SaaS would leave no application for the team to write.
Source: NIST SP 800-145, The NIST Definition of Cloud Computing (service model: Platform as a Service)Report a problem with this question
17. Moving from IaaS to PaaS to SaaS, how does the share of the stack that the customer manages itself change?
- A.It shrinks at each step, because the provider takes over more of the layers beneath the workload✓ Answer
- B.It grows at each step, because the customer must integrate with more of the provider's own tooling
- C.It stays the same at each step, because the same layers are managed whichever model is chosen
- D.It shrinks for storage only, because compute stays the customer's responsibility in every model
Each model hands more of the underlying stack to the provider: IaaS leaves the operating system and everything above it to the customer, PaaS absorbs the operating system and runtime, and SaaS absorbs the application as well. The customer's remaining scope therefore narrows at every step, although its data and accounts never leave its hands.
Source: NIST SP 800-145, The NIST Definition of Cloud Computing (consumer control under IaaS, PaaS and SaaS); ISC2 CC Exam Outline, Networking and Cloud Security Concepts — shared security modelReport a problem with this question
18. A company contracts a provider to build and operate a cloud environment used by that company alone, on hardware not shared with any other customer. Which deployment model is this?
- A.Private, because the model is decided by single-organization use rather than by who owns the hardware✓ Answer
- B.Community, because the provider's other clients share the same facility and the same support staff
- C.Hybrid, because the company's own staff and the provider's staff each administer part of the platform
- D.Public, because the environment is built and operated by an outside provider rather than by the company
A private cloud is defined by exclusive use by a single organization; it may be owned, managed and operated by the organization, by a third party, or a combination, and it may exist on or off the premises. Assuming that private must mean self-hosted is the common error this scenario targets.
Source: NIST SP 800-145, The NIST Definition of Cloud Computing (deployment model: private cloud)Report a problem with this question
19. A firm keeps its regulated records in an environment dedicated to itself, runs its public marketing site on a shared provider platform, and links the two. Which deployment model describes the result?
- A.Public, because placing any workload with an outside provider makes the whole estate public
- B.Community, because the firm shares a platform with other organizations facing the same rules
- C.Hybrid, because two distinct deployment models stay separate yet are bound together by the firm✓ Answer
- D.Private, because the most sensitive workload decides how the whole estate is classified
A hybrid cloud is a composition of two or more distinct deployments that remain unique entities but are bound together so data and applications can move between them, which is precisely the private-plus-public arrangement described. A community cloud would require other organizations to share the environment, and no single workload reclassifies the whole estate.
Source: NIST SP 800-145, The NIST Definition of Cloud Computing (deployment model: hybrid cloud)Report a problem with this question
20. Under IaaS, PaaS and SaaS alike, which responsibilities stay with the customer in every case?
- A.The hypervisor software, the storage arrays and the network fabric inside the provider's facility
- B.The physical security of the data centre and the safe disposal of failed disks holding its records
- C.The customer's own data, the identities and rights it grants, and the configuration choices it makes✓ Answer
- D.The patching of the host operating systems that run beneath the provider's virtualization layer
The dividing line is security of the cloud versus security in the cloud: the provider secures the facility, the hardware and the virtualization layer, while the customer always keeps what only it can decide — its data, who is given an identity and what rights they hold, and how its services are configured. This invariant holds even in SaaS, where almost everything else has moved to the provider.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — Shared security model — roles and responsibilities; NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud ComputingReport a problem with this question
21. Which responsibility belongs to the cloud service provider under every service model?
- A.Classifying the customer's records and deciding which of them may be shared outside
- B.Securing the physical facility and its hardware, together with the virtualization layer✓ Answer
- C.Creating the customer's user accounts and reviewing their permissions over time
- D.Setting the customer's application options and the sharing rules applied to its files
The provider owns the layers the customer cannot touch: the building, the power and physical access controls, the hardware, and the hypervisor that separates tenants. Classification, account creation and configuration all depend on the customer's own business decisions, so they never transfer to the provider.
Source: ISC2 Certified in Cybersecurity Exam Outline, Networking and Cloud Security Concepts — Shared security model; NIST SP 800-144 (division of security responsibilities in public cloud)Report a problem with this question
22. An executive says that once workloads move to a provider, any breach of the company's customer data becomes entirely the provider's problem. Which principle corrects that view?
- A.Accountability moves with the workload, so the contract makes the provider answerable to the regulator
- B.Accountability for the data stays with the company, even though tasks are delegated to the provider✓ Answer
- C.Accountability follows whichever party was operating the failing component when the incident began
- D.Accountability is split evenly by contract, so both parties are named jointly in every notification
An organization can delegate the performance of security tasks to a provider, but it cannot delegate accountability: it remains answerable for the data it collected and for choosing and overseeing the provider. This is why the contract and service level agreement exist — to define duties, audit rights and remedies, not to transfer answerability.
Source: NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing (accountability for outsourced services remains with the organization); ISC2 CC Exam Outline, Networking and Cloud Security ConceptsReport a problem with this question

Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →

1. An organization divides its network into separate segments and filters the traffic that passes between them. At the concept level, what does this segmentation mainly limit?

2. A small company runs one flat network: every workstation, server, printer and camera shares a single segment with no filtering between devices. Why is that arrangement considered dangerous?

3. An administrator claims that putting guest devices in their own VLAN isolates them completely and therefore forms a full security boundary. Which statement corrects that claim?

4. A data centre team applies filtering policy at almost every connection point so that each workload can communicate only with the specific workloads it needs. Which concept is this, and what traffic is it aimed at?

5. A firewall groups its interfaces into zones — untrusted, screened subnet and internal — and rules are written between those zones. What is the principle behind organizing a firewall this way?

6. An organization puts its public-facing servers in a screened subnet, often called a DMZ. What does that design achieve, and what does it deliberately avoid?

7. Which statement best describes defence in depth as a design principle?

8. A company's whole security design is one internet firewall: hosts run no endpoint protection, there is no internal filtering, and staff receive no security training. Which criticism is most accurate?

9. A reviewer notes that an organization's protective layers consist entirely of technical products. Which addition best extends defence in depth?

10. Which assumption does a zero trust approach deliberately abandon?

11. Under zero trust, a user who authenticated an hour ago now asks for a different internal application. What does the model require?

12. How does zero trust differ from micro-segmentation, even though organizations often deploy the two together?

13. A developer adds extra storage capacity through a provider portal within minutes and never speaks to anyone at the provider. Which essential cloud characteristic does this illustrate?

14. Virtual machines belonging to several unrelated customers run on the same physical hosts, and the provider reassigns capacity among them according to demand. Which essential characteristic is this?

15. Staff open the same hosted application from company laptops, personal tablets and phones over ordinary network connections. Which essential characteristic does this describe?

16. A development team wants to write, test and deploy its own application while the provider supplies and maintains the operating system, runtime and hardware underneath it. Which service model fits?

17. Moving from IaaS to PaaS to SaaS, how does the share of the stack that the customer manages itself change?

18. A company contracts a provider to build and operate a cloud environment used by that company alone, on hardware not shared with any other customer. Which deployment model is this?

19. A firm keeps its regulated records in an environment dedicated to itself, runs its public marketing site on a shared provider platform, and links the two. Which deployment model describes the result?

20. Under IaaS, PaaS and SaaS alike, which responsibilities stay with the customer in every case?

21. Which responsibility belongs to the cloud service provider under every service model?

22. An executive says that once workloads move to a provider, any breach of the company's customer data becomes entirely the provider's problem. Which principle corrects that view?