WGU D415 Objective Assessment (Latest Update) Software Defined Networking Review| 100% Verified Questions & Answers | Grade A

WGU D415 Objective Assessment (Latest Update) Software Defined Networking Review| 100% Verified Questions & Answers | Grade A 2026/2027 | GRADED A+ | 100 out of 100 Question: Network Functions Virtualization (NFV) Answer Moved network functions from stand-alone appliances to software running on any server, reducing the time-to-market for products. Question: Software-Defined Networks (SDN) Answer This architecture decouples the network control and forwarding functions enabling the network control to become directly programmable and the underlying infrastructure to be abstracted for applications and network services. Question: NFV Components Answer Virtual Network Functions (VNFs) Network Functions Virtualization Infrastructure (NFVI) NFV Management and Orchestration (NFV-MANO) Question: NFV Management and Orchestration (NFV-MANO) Answer Consists of all functional blocks, data repositories, reference points, and interfaces that are used for managing and orchestrating VNFs and the NFVI. Question: Network Functions Virtualization Infrastructure (NFVI) Answer Is the entirety of the hardware and software components that build the environment where VNFs are deployed. Question: Virtual Network Functions (VNFs) Answer Are the software implementations of network functions. Question: Open Platform for NFV (OPNFV) Answer Created by the Linux Foundation in 2014 and is a collaborative open-source platform that seeks to develop NFV and shape its evolution. Question: OpenStack Answer An open-source cloud computing platform that has high market penetration that includes a collection of interoperable modules that are used to orchestrate large pools of compute, storage, and networking resources. Question: Nova Answer OpenStack compute module, is used to create and delete compute instances as required. Question: Glance Answer OpenStack module that synchronizes and maintains VM images across the com pute cluster. Question: Keystone Answer Module that provides authentication for accessing all OpenStack services. Question: Cinder Answer OpenStack module that provides block storage used as storage volumes for VMs. Question: Swift Answer OpenStack module that provides object storage that is used to store large amounts of static data in a cluster. Question: Neutron Answer or networking, OpenStack module that allows the different compute instances and storage nodes to communicate with each other. Question: Horizon Answer OpenStack module provides a GUI dashboard, and is by far the most widely deployed management module. Question: Heat Answer OpenStack module that helps expedite orchestration of applications across multiple compute instances by using templates. Question: Celiometer Answer OpenStack module that monitors the NFVI and helps identify bottlenecks and resource optimization opportunities. Question: Ironic Answer OpenStack module that is a provisioning tool for baremetal installation of compute capabilities instead of VMs in OpenStack. Question: Congress Answer OpenStack module that is a policy management framework for the OpenStack environment. Question: Designate Answer OpenStack module that is used to point applications in the OpenStack environment to a trusted DNS source. Question: Barbican Answer OpenStack module that works with Keystone authentication to manage internal application security by behaving as a key manager. Question: Murano Answer OpenStack module that provides a white list repository of applications. Question: Trove Answer OpenStack module that provides a distributed database service and enables users to deploy relational and non- relational database engines. Question: Sahara Answer OpenStack module formerly called Savanna, provides big data services by providing Elastic MapReduce and ability to provision Hadoop. Question: Manila Answer Openstack module that provides Network Area Storage (NAS) solutions for an OpenStack deployment. Question: Zaqar Answer OpenStack module that provides a multi-tenant cloud messaging service. Question: Magnum Answer OpenStack module that is an umbrella project that provides containerization assistance. This module is still in development. Question: Dynamic Host Configuration Protocol (DHCP) Answer A network management protocol used to dynamically assign an Internet Protocol (IP) address to any device, or node, on a network so they can communicate using IP. Question: UDP port number 67 Answer Destination port of a DHCP server Question: UDP port number 68 Answer Destination port of a DHCP client Question: ioctl interface Answer Linux Bridge Configuration offers an interface that can be used to create and destroy bridges in the operating system, and it can also add network interfaces and remove existing network interfaces to / from the bridge. Question: sysfs-based interface Answer Linux Bridge Configuration allows the management of bridge and bridge port specific parameters. Question: Virtual Network Answer a mapping of the entire or subset of networking resources to a specific protocol layer. Question: Network Virtualization (NV) Answer Defined by the ability to create logical, virtual networks that are decoupled from the underlying network hardware to ensure the network can better integrate with and support increasingly virtual environments. Question: Two most common forms of NVs Answer Protocol-based virtual networks Virtual networks that are based on virtual devices Question: Virtual Private Networks (VPNs) Answer protocol-based virtual networks usually built on tunneling protocols, which consists of multiple remote end-points (typically routers, VPN gateways of software clients) joined by some sort of tunnel over another network, usually a third-party net work. Question: Virtual LANs (VLANs) Answer Protocol-based virtual networks that are logical local area networks (LANs) based on physical LANs Virtual Private LAN Services (VPLS) Answer A specific type of Multipoint VPN that is divided into Trans parent LAN Services (TLS) and Ethernet Virtual Connection Services. Virtualization Answer Refers to the act of creating a virtual (rather than actual) version of something, including virtual computer hardware platforms, storage devices, and computer network resources. Replication Answer To create multiple instances of the resource Isolation Answer To separate the uses which clients make of the underlying resources Overlay network Answer It describes a computer network that is built on top of another network. Virtual Network Embedding (VNE) problem Answer How to optimally allocate virtual networks and their associated networking resources. hub Answer a physical-layer device where a frame is passed along or broadcast to every one of its ports. It does not matter that the frame is only destined for one port. switch Answer Responsible for connecting several network links to each other, creating a Local Area Network (LAN). a data-link layer device that keeps a record of the MAC addresses of all the devices connected to it and with this information it can identify which system is sitting on which port. As the result, when a frame is received, it knows exactly which port to send the frame to, without significantly increasing network response times. bridge Answer A device that separates two or more network segments within one logical network. Open vSwitch (OVS) Answer A multi-layer software switch licensed under the open source Apache 2 license. Linux bridge Answer A native function on Linux kernel with layer-2 capabilities, which can be considered as an Ethernet Hub OpenFlow Allows a controller to add, remove, update, monitor, and obtain statistics on flow tables and their flows, as well as to divert selected packets to the controller and to inject packets from the controller into the switch. L2TP (Layer 2 Tunneling Protocol) a tunneling protocol used to support VPNs or as part of the delivery of services by ISPs. It does not provide any encryption or confidentiality by itself. Rather, it relies on an encryption protocol that it passes within the tunnel to provide privacy. PPP (Point-to-Point Protocol) A data link (layer 2) protocol used to establish a direct connection between two nodes. It connects two routers directly without any host or any other networking device in between. It can provide connection authentication, transmission encryption, and compression. VXLAN (Virtual Extensible LAN) Network virtualization technology that attempts to improve the scalability problems associated with large cloud computing deployments. It uses a VLAN-like encapsulation technique to encapsulate layer 2 Ethernet frames within layer 4 UDP packets Generic Routing Encapsulation (GRE) A communication protocol used to establish a direct, point-to-point connection between network nodes. Being a simple and effective method of transporting data over a public network, such as the Internet, it lets two peers share data they will not be able to share over the public network itself. SSL (Secure Socket Layer) A standard security technology for estab lishing an encrypted link between a server and a client - typically a web server (website) and a browser, or a mail server and a mail client (e.g., Outlook) by encrypting data above the transport layer. IPSec A network protocol suite that authenticates and encrypts the packets of data sent over a network at the IP layer. IPsec includes protocols for establishing mutual authentication between agents at the beginning of the session and negotiation of cryptographic keys for use during the session. IEEE 802.1Q A protocol for carrying VLAN traffic on Ethernet. Maximum Transmission Unit (MTU) The size of the largest block of data that can be sent as a single unit. Southbound Interface (SBI) Allows the controller to communicate, interact and manage the forwarding elements. East / Westbound interfaces Are meant for communication between groups or federations of controllers. Northbound Interface (NBI) Enables applications in the application layer to program the controllers by making abstract data models and other functionalities available to them. Unified control plane of an SDN Consists of one or more SDN con trollers that use open APIs to exert control over the underlying vSwitches or forwarding devices. Data plane in SDN Tasked with enabling the transfer of data from the sender to the receiver(s). OpenFlow Defined by the ONF, is a protocol between the control and forwarding layers of an SDN architecture, and is by far the most widespread implementation of SDN. SDN Controllers The brains of the SDN operation that lies between the data plane devices on one end, and high level applications on the other. Takes the responsibility of establishing every flow in the network by installing flow entries on switch devices. NOX Was among the fi rst publicly available OpenFlow controller. OpenDaylight (ODL) An open-source SDN controller that has been available since 2014. It is a modular multi-protocol SDN control ler that is widely deployed in the industry. Open Virtual Switch (OVS) Open-source implementation of a distributed programmable virtual multi-layer switch. Generally consist of flow tables, with each flow entry having match conditions and associated actions. Communicates with the controller using a secure channel, and generally uses the OpenFlow protocol. Routing Control Platform (RCP) Proposed in for the provisioning of inter-domain routing over a BGP network. Routing is done as a separate entity. Control from physically distributed entities in a domain is logically centralized in a control plane. SoftRouter Presented with the aim of separation of control and forwarding elements called Control Element (CE) and Forwarding Element (FE), respectively. The control functionality is provided by using a centralized server, i.e., a CE that might be many hops away from the FE. RouteFlow Project initially named as QuagFlow, which aimed to provide IP routing as Router-as-a-Service in a virtualized environment. Considered the basic architecture to control routing in SDNs. Virtual Router System (VRS) Virtual router instances communicate with a Point-Of-Presence (POP) and follow a star topology, in which a single core node is connected to Customer Edge Gateways (CEG) linked through Intermediate Nodes (INs). Vulnerability A weakness or gap in a security system that can be either exploited by attackers or caused by malfunctioning system components. Threat The possibility of exploration of vulnerabilities that can lead to something bad happening, and it emphasizes the qualitative of potential damages due to explored vulnerabilities. Attack An action triggered by deploying an attacking method, when a vulnerability is exploited to actually realize a threat. Risk The quantifiable likelihood of loss due to a realized threat, and it emphasizes the quantitative of potential damages. The source of attacks Two types of attackers based on their origins called inside attacker (or insider) and outside attacker (or out sider). The method of attacks There are two types of attack methods based on the intention of the attacker called passive attacks and active attacks. The target of attacks The objective of attackers to try to compromise. The consequence of attacks Describes outcomes by successfully deploying an attack. It is a multi-faceted consequence. Defense in depth Also known as Castle Approach is the concept of protecting a computer network with a series of defensive mechanisms such that if one mechanism fails, another will already be in place to thwart an attack. Defense in depth framework The first layer is a prevention mechanism that stops attacks from getting into the networking system. The second layer is detection and response mechanisms that watch activities on systems and networks to detect attacks and repair the damage The third layer is attack-resilient technologies that enable the core elements, or, the most valuable systems, on the network to survive attacks and continue to function. Cyber Kill Chain Adopts the concept of a procedural step-by-step attacking method consisting of target identification, force dispatch to target, decision and order to attack the target, and finally the destruction of the target. Reconnaissance The attacker gathers information on the target before the actual attack starts. Weaponization Cyber attackers do not interact with the intended victim, instead they create their attack. Delivery Transmission of the attack to the intended victim(s). Exploitation This implies actual detonation of the attack, such as the exploit running on the system. Installation The attacker may install malware on the victim. Command & Control (C&C) This implies that once a system is compromised and / or infected, the system has to call home. Actions on Objectives Once the cyber attackers establish access to the organization, they then execute actions to achieve their objectives / goal. Network mapping The study of the connectivity of networks at the layer 3 on a TCP / IP network. Vulnerability scanning An inspection of the potential points of exploit on a computer or network to identify security holes. Penetration testing Attempts to identify insecure business processes, insecure system settings, or other weaknesses. Frewall (FW) A component or set of components that restricts access between a protected network and the Internet, or between other sets of networks. Host A computer system attached to a network. Network Address Translation (NAT) A procedure by which a router changes data in packets to modify the network addresses. This allows a router to conceal the addresses of network hosts on one side of it. Perimeter network A network added between a protected network and an external network in order to provide an additional layer of security. A perimeter network is sometimes called a DMZ. Proxy A program that deals with external servers on behalf of internal clients Intrusion Prevention System (IPS) a network security / threat prevention technology that examines network traffic flows to detect and prevent vulner ability exploits. Intrusion Detection System (IDS) a network security technology originally built for detecting vulnerability exploits against a target application or computer. host-based logging This approach minimizes the network traffic by transfer ring logs into a centralized log server; however, it incurs significant manage ment overhead to retrieve logging data from individual hosts. centralized logging Individual hosts or networking devices send their logs to a centralized logging service for log management and analysis. decentralized logging Usually built on centralized logging solutions, in which multiple centralized-logging systems can be established to handle specific applications to address the scalability issues. Centralized logging interdependent services Collect logs Transport Store Analyze Alerting Log Collection Centralized logging interdendent service that uses one of two basic approaches 1. The replication approach, where files are replicated to a central server on a fixed schedule. 2. Direct remote logging protocol to send log data when generated from the system without a delay such as syslog. Log Transport frameworks One way is directly plug input sources and framework can start collecting logs and another way is to send log data via API. Log storage factors Time - for how long should logged data be stored? Volume - how huge would the logged data be? Access - how will you access the logs? IEEE 1588 Standard for a Precision Time Protocol (PTP) that enables precise synchronization of clocks in measurement and control systems implemented with technologies such as network communication, local computing, and distributed objects. SDLC 5 phases Initiation Acquisition and development Implementation Operations and maintenance Disposition SDLC Initiation Phase Security categorization Preliminary risk assessment SDLC Acquisition and Development Phase Risk assessment Security functional requirements analysis Security assurance requirements analysis Cost considerations and reporting Security planning Security control development Developmental security test and evaluation Other planning components SDLC Implementation Phase Inspection and acceptance System integration Security certification Security accreditation SDLC Operations and Maintenance Phase Configuration management and control Continuous monitoring SDLC Disposition Phase Information preservation Media sanitization Hardware and software disposal Secure Boot technology that can help maintain validation and assurance of Boot Integrity. Provides assurance that the code loaded in VNF execution environment is authentic, and has not been tampered with. TAP or SPAN port IDS solutions will often use to analyze a copy of the inline traffic stream (and thus ensuring that IDS does not impact inline network performance). Resource isolation methods physical segregation of hardware resources rate-limiting the usage of VNF resources Divide resources scheduling mechanism (round-robin/fair-queue) bastion host Attached to the perimeter network and this host is the main point of contact for incoming connections from the outside world. SDN Security mechanisms Replication Diversity Automated Recovery Dynamic Device Association Controller-Switch trust Controller-App plane trust Security domains Side-channel attacks Data-plane attack where the attacker can observe the processing time of the control plane in order to learn the network configuration. VM-FW-R1 NIST 800-125B recommendation that states in virtualized environments with VMs running delay sensitive applications, virtual firewalls should be deployed for traffic flow control instead of physical fi rewalls VM-FW-R2 NIST 800-125B recommendation that states in virtualized environments with VMs running I / O intensive applications, kernel-based virtual firewalls should be deployed instead of subnet-level virtual firewalls, VM-FW-R3 NIST 800-125B recommendation that states for both subnet-level and kernel-based virtual firewalls, it is preferable if the firewall is integrated with a virtualization management platform rather than being accessible only through a stand alone console. VM-FW-R4 NIST 800-125B recommendation that states for both subnet-level and kernel-based virtual firewalls, it is preferable that the firewall supports rules using higher-level components or abstractions (e.g., security group) in addition to the basic 5-tuple (source / destination IP address, source / destination ports, protocol). Chef a configuration management tool written in Ruby and uses a pure Ruby, domain-specific language (DSL) for writing system configuration "recipes" These recipes which are grouped together and called a cookbook for easier management, describe a series of resources in an optimal state Ansible An open-source suite of tools for software provisioning, configuration management, and application deployment agentless and relies on temporary remote connections (over standard SSH by default) without installing agents on the controlled node. Works with "playbooks" which are configuration files written in YAML and are used to store automation instructions. Puppet Most well-known and matured configuration management tool Uses specific modules written in either using its own declarative language or a Ruby DSL (domain-specific language) for configuration management. Apstra Juniper software that automates and validates your data center network design, deployment, and operations across a wide range of vendors. Benefits of NFV Automating the orchestration and management lets an NFVI be more scalable and achieve better resource utilization. Using generic server hardware that can act as any number of network devices instead of specialized hardware that perform singular functions helps reduce both operational and capital expenditures. virtualization offers carriers the ability to offer pay-as-you-go services without huge up-front investment. Avoiding proprietary hardware empowers administrators with a streamlined provisioning process. Domain Name System (DNS) a hierarchical decentralized naming system for computers, services, or other resources connected to the Internet or a private network. PREROUTING NAT table chain that is done at first when a packet is received and is thus routed based on where it is going (destination). POSTROUTING After all other routing rules have been applied, the NAT chain that will determine where it goes based on where it came from (source). iptables The basic firewall software most commonly used in Linux netfilter framework The iptables firewall works by interacting with the packet filtering hooks in the Linux kernel's networking stack. It is a command-line interface to the packet filtering functionality in netfilter. Application layer Contains the typical network applications or functions organizations use and talk to control layer via NBI Control layer Represents the centralized SDN controller software that acts as the brain of the software-defined network. Communicates with Application layer via NBI and the Infrastructure layer via SBI. Infrastructure layer is made up of the physical switches in the network. These switches forward the network traffic to their destinations and communicates with control layer via SBI. physical network Visible and physically presented to connect physical computers. logical network A virtual representation of a network that appears to the user as an entirely separate and self-contained network even though it might physically be only a portion of a larger network or a local area network. overlay network A virtual network of nodes and logical links that are built on top of an existing network with the purpose of implementing a net work service that is not available in the existing network. Address Resolution Protocol (ARP) A communication protocol used for discovering the link layer address, such as a MAC address, associated with a given network layer address, typically an IPv4 address. Role-based access control (RBAC) Concept that is used to create differentiated access based on entitlement to administer a network device or controller VNFM (VNF Manager) Responsible for basic lifecycle management operations such as create / update / delete, platform aware NFV load optimization, health monitoring, auto-scaling and VNF configuration management operations. NFV Catalog Consists of VNF Descriptors, Network Service Descriptors and VNF Forwarding Graph Descriptors NFVO (NFV Orchestrator) Responsible for VIM resource check and allocation, SFC management using VNF Forwarding Graph descriptor, VNF placement policy, network service deployment using decomposed VNFs. Security mechanism - Replication Can help in dealing with cases of controller or application failures due to a high volume of traf fi c or software vulnerabilities. Security mechanism - Diversity Improves the robustness and intrusion tolerance. The use of diverse controllers can help reduce lateral movement of an attacker and cascading system failures caused by common vulnerabilities. Security mechanism - Automated Recovery In the case of security attacks, leading to service disruption, the proactive and reactive security recovery mecha nisms can help in maintaining optimal service availability. Security mechanism - Dynamic Device Association Helps in dealing with faults (crash or Byzantine). Other advantages include load balancing feature provided by diverse controllers (reduced service latency). Security mechanism - Controller-Switch Trust A trust establishment mechanism between the controller and switch is important to deal with cases of fake flows being inserted by malicious switches. Security mechanism - Controller-App Plane Trust Controller and application plane components should use autonomic trust management mecha nisms based on mutual- trust and delegated trust (3rd part such as the Certi fi cate Authority to establish trust). Security mechanism - Security Domains Help in segmenting the network into different levels of trust, and containment of the threats to only the affected section in the SDN framework. Clustering Adds a layer of defense against the controller being a single point of failure by having one or more controllers in an active / standby scenario. MTD - Shuffling Involves rearrangement of resources at various layers. Some examples include migration of VM from one physical server to another, application migration, instruction set randomization (ISR), etc. MTD - Diversification Modify the network function or software responsible for the functioning of an application or the underlying compiler to diversify the attack surface. MTD - Redundancy Creates multiple replicas of a network component in order to maintain an optimal level of service in case of network attacks like DDoS attacks. Another benefit is that we can create decoys in the network for increasing the discovery time of the actual target. Network Level MTD Requires a change in the network parameters, such as network con fi guration, network connection obfuscation and Routing Randomization. Host Level MTD Requires a change in host resources, OS, and renaming of con fi gurations. Application Level MTD Involves a change in the application required, source code, memory mapping, and software version. Common Vulnerability Scoring System (CVSS) An open-source framework that defines characteristics of software vulnerabilities. Proactive security Refers to a new paradigm of security management, where instead of defending the network infrastructure by detecting, preventing, tracking and remediation of threats, attack surface is changed over time. asset Anything of value to an organization