Question
You are designing a campus network with a three-tier hierarchy and need to ensure secure connectivity between locations and traveling employees. The diagram shows an egress zone (Internet and WAN routers, firewalls, anti-DDoS), a data center, a branch campus and the campus switching tiers. The command output from the hosts is:
| Host | IPv4 address | Subnet mask | Default gateway |
|---|---|---|---|
| Data center server | 10.31.2.5 | 255.255.255.0 | 10.31.2.1 |
| Branch campus laptop | 10.31.10.5 | 255.255.255.0 | 10.31.10.1 |
| Workstation 1 | 10.31.5.5 | 255.255.255.0 | 10.31.5.1 |
| Workstation 2 | 10.31.6.5 | 255.255.255.0 | 10.31.6.1 |
| Workstation 3 | 10.31.7.5 | 255.255.255.0 | 10.31.7.1 |
Select the appropriate technology for the egress zone and the label for each layer on the diagram. Each option may be used only once.
Explanation
Egress zone technology: a web application firewall (WAF) sits in the egress zone, in front of the applications that traveling employees and the branch campus reach from the Internet and WAN, and filters HTTP/HTTPS requests for application-layer attacks such as injection and cross-site scripting. The firewalls and anti-DDoS appliances already in the zone handle network-layer filtering and volumetric attacks, so the missing control is application-layer protection. A NIDS only detects and alerts, a NIPS duplicates the packet-level inspection the existing firewalls already provide without understanding web application requests, and DLP addresses sensitive data leaving the organization rather than protecting access to its services. Top layer: the two switches that interconnect the egress zone, the data center and every distribution block form the core layer, which provides fast, redundant transport. Middle layer: each pair of switches that aggregates a block's access switches, and where routing between the 10.31.x.0/24 subnets and policy are applied, is the distribution layer. Bottom layer: the switches and access points that connect workstations and wireless clients are the access layer.
