CompTIA Security+ (SY0-701)Security ArchitectureHard
A network engineer implements a solution where a centralized controller programmatically manages traffic flow rules across all switches and routers via a control plane separated from the data plane, allowing dynamic reconfiguration of the network through software policies. Which technology is being described?
- AVirtual private network (VPN) concentrator
- BBorder Gateway Protocol (BGP) routing
- CNetwork access control (NAC)
- DSoftware-defined networking (SDN)
Show answer & explanationAnswer & explanation
Correct answer: D. Software-defined networking (SDN)
SDN separates the control plane from the data plane and uses a centralized controller to programmatically define and adjust network behavior, enabling automated, policy-driven network management as described.
Why the other options are wrong
- A. A VPN concentrator terminates multiple VPN tunnels but does not centrally program switch/router flow rules network-wide.
- B. BGP is a routing protocol for exchanging routes between autonomous systems, not a centralized software control architecture.
- C. NAC enforces endpoint compliance/authentication policies before granting network access, not centralized flow programming.
Software-Defined Networking (SDN)
A network architecture that separates the control plane from the data plane, using a centralized controller to programmatically manage traffic flow across the network.
- Enables dynamic, policy-based network reconfiguration
- Common in cloud data centers and microservice environments
- Controller compromise is a key security risk (single point of control)
Memory trick: SDN = a joystick controlling the whole network from one seat.