Examkin

Question

Difficulty: HardNetwork Components Roles and Functions

A network architect is designing an enterprise branch network that requires high-speed inter-VLAN routing for internal communication between local subnets, alongside deep packet inspection, stateful traffic monitoring, and intrusion prevention for all internet-bound traffic. Which deployment strategy correctly assigns these operational roles to the appropriate network components to maximize performance and security?

  1. Perform local inter-VLAN packet forwarding on a Layer 3 switch using ASIC-based routing, and forward external traffic to a Next-Generation Firewall (NGFW) for application-layer inspection and security enforcement.Answer
  2. B
    Perform local inter-VLAN routing on an unmanaged Layer 2 switch to break up broadcast domains, and rely on client endpoint NICs to inspect application-layer payloads for external traffic.
  3. C
    Install a Type 2 hypervisor directly on bare-metal hardware at the network boundary to handle line-rate inter-VLAN routing and hardware-level packet switching without an OS host.
  4. D
    Configure Layer 2 discovery protocols (CDP/LLDP) on access switches to perform stateful security filtering and inspect TCP application payloads between subnets.

Answer

Local inter-VLAN routing should be performed on a Layer 3 switch using ASIC-based forwarding, while edge traffic should be directed through a Next-Generation Firewall (NGFW) for stateful application-layer inspection.
In enterprise architecture, assigning Layer 3 switches to handle inter-VLAN routing leverages ASIC hardware for high-bandwidth, low-latency internal traffic forwarding. Positioning a Next-Generation Firewall (NGFW) at the network perimeter provides dedicated stateful packet inspection, application recognition, and security policy enforcement for external traffic.

Step-by-Step Solution

1
Analyze the requirements for internal inter-VLAN routing.
Layer 3 switches use dedicated hardware Application-Specific Integrated Circuits (ASICs) to route traffic between local VLANs at wire speed with minimal latency.
Routing internal subnets at Layer 3 on switch hardware offloads throughput demands from security edge devices.
2
Analyze the requirements for external internet-bound security enforcement.
Next-Generation Firewalls (NGFWs) perform stateful packet inspection, deep packet inspection (DPI), and application-level security policy enforcement.
Standard Layer 3 switches lack advanced threat prevention, deep packet inspection, and stateful application control features.
3
Evaluate component assignments.
Combining Layer 3 switches for internal forwarding with an NGFW at the internet perimeter fulfills both high throughput and robust security requirements.
This functional division adheres to Cisco enterprise architectural best practices.

Key Concept

Operational roles and functional differentiation of Layer 3 switches and Next-Generation Firewalls (NGFWs) in enterprise design.
Estimated Time:2m 0s
Rate this question

Topics

Network Components Roles and Functions

More questions from this topic