712-50 exam dumps: questions 301 to 400 of 455

Correct answer: A

• A. Correct.

  Correct. A hub operates at OSI Layer 1 and repeats incoming frames out all other ports, meaning hosts on the same segment can see traffic not intended for them. Replacing it with a switch materially improves confidentiality on the local network because a switch forwards frames based on MAC address tables rather than broadcasting all traffic to every port. Using a managed switch also enables segmentation through VLANs, which can further reduce exposure between groups and support stronger security controls. This is the most direct and practical fix for the stated problem.

• B. Incorrect.

  Incorrect. While routers separate broadcast domains and can enforce policy between networks, they do not solve the core issue described here: traffic exposure on the local shared Ethernet segment created by the hub. Updating router firmware may be good operational hygiene, but it does not change the fact that hosts attached to the hub can passively observe local traffic before it ever reaches the router.

• C. Incorrect.

  Incorrect. The transport protocol choice does not address the Layer 1/Layer 2 issue caused by the hub. Both TCP and UDP traffic can be captured by any host that receives the frames on a shared medium. Someone might pick this option because TCP is associated with sessions and reliability, but protocol substitution is not a valid mitigation for promiscuous capture on a hub-based segment.

• D. Incorrect.

  Incorrect. Adding another hub would preserve the same fundamental weakness because hubs do not provide traffic isolation between attached devices. Although separate hubs could create different collision domains depending on topology, they still do not provide the switching logic needed to limit frame delivery to the intended port. This option reflects a common misconception that simply dividing users across more shared devices meaningfully improves confidentiality.

Correct answer: A

• A. Correct.

  Correct. Network segmentation is intended to limit unnecessary connectivity and contain compromise. Placing the manufacturing environment in a dedicated segment and enforcing least-privilege traffic flows through firewalls or ACLs directly addresses the board's concern about ransomware spreading laterally from the corporate network. This approach is especially appropriate for legacy or unpatchable systems because it reduces their exposure while preserving only the specific business-required communications.

• B. Incorrect.

  Incorrect. Endpoint protection can be useful, but it does not replace segmentation. Keeping vulnerable manufacturing systems on a flat network preserves broad east-west connectivity, which increases the chance of lateral movement if either a user workstation or a production asset is compromised. The misconception is treating endpoint controls as sufficient compensation for weak network architecture.

• C. Incorrect.

  Incorrect. VPN usage controls remote access, not internal trust boundaries. If the manufacturing systems remain on the same subnet or broadly reachable network, lateral movement risk inside the environment remains largely unchanged. This option confuses access authentication with segmentation and containment.

• D. Incorrect.

  Incorrect. Better perimeter filtering may reduce some initial infection vectors, but it does not adequately address the stated risk of ransomware propagating from corporate systems into production operations after an internal compromise. The misconception is focusing only on ingress prevention rather than limiting blast radius through internal segmentation.

Correct answer: A

• A. Correct.

  Correct. Effective network segmentation creates distinct trust zones based on business function and risk, then controls communications between them with explicit policy enforcement. Separating POS, user endpoints, development systems, and vendor access limits lateral movement and reduces the impact of a compromise. Restricting east-west traffic to only necessary ports and applications reflects least privilege and is consistent with common security architecture guidance and PCI DSS expectations for isolating the cardholder data environment.

• B. Incorrect.

  Incorrect. Endpoint antivirus and EDR are important detective and response controls, but they do not replace segmentation. A flat internal network still allows an attacker or malware more opportunities for lateral movement if endpoint controls fail or are bypassed. This option reflects the misconception that strong endpoint security alone can compensate for poor network architecture.

• C. Incorrect.

  Incorrect. Changing IP ranges without enforcing traffic controls is not meaningful segmentation. If unrestricted routing remains in place, systems are still effectively on a flat trust model from a security perspective. This is a common misunderstanding: logical separation by addressing alone does not reduce attack paths unless policy enforcement restricts communications.

• D. Incorrect.

  Incorrect. Multifactor authentication for administrators improves identity security, but it does not address the broader risk of malware or unauthorized lateral movement among systems. Network segmentation is about limiting connectivity and trust relationships across network zones, not just strengthening privileged access.

Correct answer: B

• A. Incorrect.

  This is incorrect. WPA2-Personal uses a shared pre-shared key rather than per-user 802.1X authentication, which weakens identity-based access control, complicates accountability, and does not adequately address evil twin credential harvesting. In many enterprise phishing scenarios, moving to PSK can actually reduce security maturity by removing centralized authentication and increasing key-sharing risk.

• B. Correct.

  This is correct. Evil twin attacks against enterprise Wi-Fi often rely on clients trusting a rogue access point and then presenting credentials to a fake authentication infrastructure. Requiring proper validation of the authentication server certificate and using an EAP method designed for secure mutual authentication significantly reduces the likelihood that clients will disclose credentials to a rogue network. This preserves the benefits of centralized authentication, supports scale, and aligns with enterprise wireless security best practices.

• C. Incorrect.

  This is incorrect. Disabling SSID broadcast does not provide meaningful protection against determined attackers because the SSID can still be learned through normal wireless traffic analysis. It also does not prevent an attacker from advertising the same SSID. This is a common but outdated misconception that hidden SSIDs materially improve wireless security.

• D. Incorrect.

  This is incorrect. Adjusting transmit power may have limited value for coverage tuning and interference management, but it does not address the root cause of evil twin attacks: clients failing to verify the authenticity of the network and authentication server. A rogue access point can still attract clients if certificate validation is not enforced.

Correct answer: B

• A. Incorrect.

  This is incorrect because WPA3-Personal still relies on a shared password model, even though it improves security over older pre-shared key approaches. A complex passphrase and periodic rotation do not solve the core governance and operational problem of credential sharing among employees. For an enterprise that wants centralized identity-based control, rapid revocation of individual access, and better auditability, a personal mode based on a shared secret is not the best baseline.

• B. Correct.

  This is correct because WPA2-Enterprise or WPA3-Enterprise with 802.1X provides per-user or per-device authentication tied to centralized identity services through RADIUS. This aligns with enterprise governance goals such as individual accountability, easier credential revocation when staff leave, stronger access control, and reduced exposure from shared passwords. It also accommodates the scenario constraint that older warehouse devices support 802.1X even if they do not support the newest Wi-Fi standard. In practice, an enterprise may use WPA3-Enterprise where supported and WPA2-Enterprise for legacy compatibility during a controlled transition.

• C. Incorrect.

  This is incorrect because an open wireless network exposes management and onboarding risks and does not provide native WLAN access control or encryption in the same way an enterprise-protected SSID does. Although VPN can add encryption for application traffic, it is not a substitute for secure wireless authentication and authorization at the network access layer. This choice would also increase operational complexity and risk, especially before the VPN tunnel is established.

• D. Incorrect.

  This is incorrect because MAC filtering and hidden SSIDs are weak controls that can be bypassed with basic wireless reconnaissance techniques. MAC addresses can be spoofed, and hidden SSIDs are easily discovered from client association traffic. These measures may be used as minor administrative hurdles, but they are not appropriate as the enterprise baseline for securing employee wireless access.